Threats tagged 'ghsa-pw3r-7vg3-gqch'

Tactical RMM versions 0.17.0 through 1.6.1 have an arbitrary file read vulnerability in the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint processes file:// links in user-supplied templates and embeds the referenced files into generated PDFs. Users with report management permissions can exploit this to read sensitive files, including the Django SECRET_KEY, which is reused as the NATS password, enabling them to execute runscript commands on all managed agents.