CVE-2025-69516
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to...
- Published
- Jan 29, 2026
- Updated
- Jan 29, 2026
- Assigning CNA
- mitre
- Evidence observed
- Aug 6, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 83.1%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.
Sources
modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Python,Unix($.exploit_linux/http/tacticalrmm_ssti_rce_cve_2025_69516.platform)
- verification: check_declared($.exploit_linux/http/tacticalrmm_ssti_rce_cve_2025_69516.check)
- CVE-2025-69516Exploit
Tactical RMM Exploit
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.