CVE-2025-69516

HIGH

Amidaware Tactical RMM <=1.3.1 - SSTI

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2025-69516. PoCs published by NtGabrielGomes, SNISS, Gabriel Gomes, including Metasploit module exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-69516, a Server-Side Template Injection (SSTI) vulnerability in Tactical RMM. The exploit leverages Jinja2 template injection to achieve remote code execution by crafting a malicious template payload.

Description

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.

Exploits (3)

nomisec WORKING POC 4 stars
by NtGabrielGomes · poc
https://github.com/NtGabrielGomes/CVE-2025-69516

This repository contains a functional Python exploit for CVE-2025-69516, a Server-Side Template Injection (SSTI) vulnerability in Tactical RMM. The exploit leverages Jinja2 template injection to achieve remote code execution by crafting a malicious template payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tactical RMM version 1.3.1
Auth required
Prerequisites: Valid session token for API authentication · Access to the vulnerable endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by SNISS · poc
https://github.com/SNISS/CVE-2025-69516

This repository contains a functional Python exploit for CVE-2025-69516, a Server-Side Template Injection (SSTI) vulnerability in Tactical RMM. The exploit leverages Jinja2 template injection to achieve remote code execution by crafting a malicious template payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tactical RMM version 1.3.1
Auth required
Prerequisites: valid authorization token · access to the Tactical RMM API endpoint
devstral-2 · analyzed Mar 14, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Gabriel Gomes · rubypocpython
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb

This Metasploit module exploits a Server-Side Template Injection (SSTI) vulnerability in Tactical RMM versions prior to 1.4.0. It authenticates with valid credentials, obtains a Knox API token, and delivers a Jinja2 SSTI payload through the template preview functionality to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tactical RMM < 1.4.0
Auth required
Prerequisites: Valid Tactical RMM credentials · Network access to the Tactical RMM API
devstral-2 · analyzed Mar 05, 2026 Full analysis →

Scores

CVSS v3 8.8
EPSS 0.5558
EPSS Percentile 98.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1336
Status published
Products (1)
amidaware/tactical_rmm < 1.4.0
Published Jan 29, 2026
Tracked Since Feb 18, 2026