{"id":"CVE-2026-129165","summary":"Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview","details":"Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.","modified":"2026-11-14T10:31:00.838747199Z","published":"2026-11-13T17:21:52.384Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129165.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129165.json"},{"type":"PACKAGE","url":"https://github.com/amidaware/tacticalrmm"},{"type":"ARTICLE","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/utils.py#L110-L117"},{"type":"ARTICLE","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/views.py#L202-L245"},{"type":"ARTICLE","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/tacticalrmm/utils.py#L227-L236"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129165"},{"type":"ADVISORY","url":"https://vul.yulun.ac.cn/20261028/tacticalrmm/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/tactical-rmm-0.17.0-through-1.6.1-arbitrary-file-read-via-report-preview"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/amidaware/tacticalrmm","events":[{"introduced":"9ee246440faca57f8532ad121f3de07076f1911a"},{"last_affected":"086e2d9714b1716796722c7e0c19a1ebe08a39f2"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.17.0"},{"last_affected":"1.6.1"}]}]}}],"versions":["v1.6.1","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.20.1","v0.20.0","v0.19.4","v0.19.3","v0.19.2","v0.19.1","v0.19.0","v0.18.2","v0.18.1","v0.18.0","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129165.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}