See how tactical rmm compares to other vendors in security performance
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied templatemd and embeds the files in the returned PDF. Users with report management permission can read the Django SECRETKEY, reused as the NATS password, and publish runscript commands to every managed agent.
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.