Security Advisory — CVE-2025-69516 Key Information Disclosure Date: 2025-12-24 CVE ID: CVE-2025-69516 Reporter(s): Gabriel Gomes, João Lobo Procopio, Anderson Vilela Moraes Vendor: Amidaware Inc. Product/Component: Tactical RMM Affected Versions: 1.3.1 and previous versions CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine Attack Vector: Remote Privileges Required: authenticated user CVSS: 8.8 Vulnerability Description A Server-Side Template Injection (SSTI) vulnerability in the endpoint of Amidaware Tactical RMM, affecting 1.3.1 and previous versions, allows low-privileged authenticated users with Report Viewer or Report Manager permissions to execute remote commands on the server. This issue is caused by improper sanitization of the parameter, allowing direct injection of Jinja2 templates. Impact An authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary commands on the Tactical RMM server, potentially resulting in full system compromise. Mitigation Update to v1.4.0 version. Timeline / Status 2026-01-14 — CVE reserved (CVE-2025-69516) by MITRE. 2026-01-27 — Public advisory published by researchers. Contact For coordination, secure PoC requests, or further inquiries: research3ers@proton.me References CVE record: https://www.cve.org/CVERecord?id=CVE-2025-69516