{"id":"CVE-2025-69516","aliases":["EUVD-2025-206512","GHSA-8g9w-79w6-cw84"],"status":"published","title":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/...","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.02281,"percentile":0.83291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1336"],"published":"2026-01-29T00:00:00Z","modified":"2026-10-28T02:30:46Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/tacticalrmm_ssti_rce_cve_2025_69516","title":"Tactical RMM Jinja2 SSTI Remote Code Execution","type":"exploit","platform":"Linux,Python,Unix","date":"2026-01-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/tacticalrmm_ssti_rce_cve_2025_69516"},{"source":"pocgithub","id":"SNISS/CVE-2025-69516","title":"SNISS/CVE-2025-69516","date":"2026-03-14","url":"https://github.com/SNISS/CVE-2025-69516"}],"products":[{"vendor":"amidaware","product":"tactical_rmm"}],"references":[{"url":"https://github.com/amidaware/tacticalrmm","tags":["Product","package"]},{"url":"https://www.amidaware.com/","tags":["Product","web"]},{"url":"https://gist.github.com/NtGabrielGomes/7c424367cc316fd7527f668ff076fece","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69516","tags":["advisory"]},{"url":"https://www.amidaware.com"},{"url":"https://github.com/advisories/GHSA-8g9w-79w6-cw84"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69516.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-69516","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-01-29T21:29:11.391Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-206512","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-01-29T21:29:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:45.464917Z"}],"ghsa":[{"id":"GHSA-8g9w-79w6-cw84","title":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/...","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","status":"published","published":"2026-01-29T21:30:31Z","modified":"2026-01-30T00:32:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:05:59.054519Z"}],"nvd":[{"id":"CVE-2025-69516","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","status":"published","published":"2026-01-29T20:16:09.537Z","modified":"2026-06-17T10:00:42.963Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"CVE-2025-69516","description":"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-10-28T02:30:46.165164842Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:52.859856Z"}]}}