Threats affecting pkg:github/Tactical RMM

CVE-2026-129165 is a critical vulnerability in AmidaWare Tactical RMM versions 0.17.0 through 1.6.1. It allows users with report management permissions to perform arbitrary file reads via the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint resolves file:// links in user-supplied template markdown, embedding local files into generated PDFs. Exploitation can expose the Django SECRET_KEY, which is reused as the NATS password, enabling attackers to publish runscript commands to all managed agents.