CVE-2025-69516: Tactical RMM SSTI RCE Vulnerability

CVE-2025-69516 Overview

A Server-Side Template Injection (SSTI) vulnerability has been identified in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions v1.3.1 and earlier. This vulnerability allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. The flaw stems from improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates through the misuse of the generate_html() function.

Critical Impact

Low-privileged authenticated users can achieve full remote code execution on the Tactical RMM server, potentially compromising all managed endpoints and sensitive configuration data.

Affected Products

• Amidaware Tactical RMM versions ≤ v1.3.1
• Deployments with Report Viewer or Report Manager permissions enabled
• Self-hosted Tactical RMM installations

Discovery Timeline

• 2026-01-29 - CVE-2025-69516 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-69516

Vulnerability Analysis

This Server-Side Template Injection vulnerability occurs due to unsafe handling of user-supplied input within the reporting module of Tactical RMM. The application processes user-controlled template data through the Jinja2 templating engine without proper sanitization or sandboxing. When a user with Report Viewer or Report Manager permissions submits a crafted payload via the template_md parameter, the application passes this input directly to env.from_string, which interprets the malicious content as executable Jinja2 template code.

The vulnerability is particularly concerning because it can be exploited by low-privileged users who only require Report Viewer or Report Manager permissions—roles that are commonly assigned in enterprise environments where multiple staff members need access to reporting functionality.

Root Cause

The root cause lies in the generate_html() function's misuse of Jinja2's env.from_string method. This function is designed to process Jinja2 templates dynamically from string input, making it inherently dangerous when processing untrusted user data. The application fails to implement proper input validation, output encoding, or template sandboxing before passing the template_md parameter to the templating engine. Without these protections, attackers can inject arbitrary Jinja2 syntax that gets evaluated server-side, leading to code execution.

Attack Vector

The attack is conducted over the network against the /reporting/templates/preview/ endpoint. An authenticated attacker with minimal Report Viewer or Report Manager permissions can craft a malicious HTTP request containing Jinja2 template injection payloads within the template_md parameter. Common SSTI payloads for Jinja2 exploit the template engine's ability to access Python's object model, allowing attackers to traverse object hierarchies, import modules, and ultimately execute arbitrary system commands.

Typical exploitation involves accessing Python's __class__, __mro__, __subclasses__, and __globals__ attributes to reach dangerous functions like os.popen() or subprocess.Popen(). A proof-of-concept demonstrating this vulnerability is available at the GitHub Gist PoC.

Detection Methods for CVE-2025-69516

Indicators of Compromise

• Unusual requests to the /reporting/templates/preview/ endpoint containing Jinja2 syntax patterns such as {{, {%, __class__, __mro__, or __subclasses__
• Web application logs showing template error messages or Python traceback information related to template processing
• Unexpected child processes spawned by the Tactical RMM application server, particularly shell interpreters or system utilities
• Authentication logs showing Report Viewer or Report Manager accounts making repeated API calls to reporting endpoints

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common SSTI payloads including Jinja2-specific patterns like {{config}}, {{self}}, and object traversal sequences
• Monitor application logs for template rendering errors that may indicate exploitation attempts or reconnaissance activity
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process chains originating from the Tactical RMM server process
• Enable detailed audit logging for all reporting module API endpoints and review for anomalous access patterns

Monitoring Recommendations

• Configure alerting for any requests to /reporting/templates/preview/ containing suspicious string patterns or encoded payloads
• Establish baseline behavior for Report Viewer and Report Manager account activity and alert on deviations
• Monitor network traffic from the Tactical RMM server for unexpected outbound connections that may indicate post-exploitation activity

How to Mitigate CVE-2025-69516

Immediate Actions Required

• Upgrade Amidaware Tactical RMM to a version newer than v1.3.1 that contains a fix for this vulnerability
• Review and restrict Report Viewer and Report Manager permissions to only essential personnel until patching is complete
• Implement network segmentation to limit access to the Tactical RMM server from untrusted network segments
• Enable enhanced logging and monitoring on the Tactical RMM server to detect potential exploitation attempts

Patch Information

Organizations should check the official Tactical RMM GitHub repository for security updates and patched releases. Consult the Amidaware website for official security advisories and upgrade guidance. Ensure you are running a version newer than v1.3.1 to remediate this vulnerability.

Workarounds

• Restrict access to the /reporting/templates/preview/ endpoint at the reverse proxy or firewall level until a patch can be applied
• Temporarily revoke Report Viewer and Report Manager permissions from non-essential users to reduce the attack surface
• Implement web application firewall rules to block requests containing Jinja2 template syntax in the template_md parameter
• Consider placing the Tactical RMM server behind a VPN or zero-trust network access solution to limit exposure

# Example: Block suspicious requests at nginx reverse proxy
# Add to nginx server configuration for Tactical RMM
location /reporting/templates/preview/ {
    # Deny access until patch is applied
    # Or implement strict allowlist
    if ($request_body ~* "(\{\{|\{%)") {
        return 403;
    }
}