CVE-2026-110592

Deferred Deferred - Pending Action

HTML Injection in BottleCRM PDF Invoice Templates

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110592

EUVD

EUVD-2026-101220

Affected Vendors & Products

Vendor	Product	Version / Range
MicroPyramid	BottleCRM	0.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

CVE-2026-110592 is an HTML injection vulnerability in BottleCRM versions 0.30 through 1.14.5. It allows authenticated organization members to inject HTML and CSS into custom invoice PDF templates. Attackers can manipulate fields like notes, terms, client name, or address to overlay or replace legitimate content such as totals, payee names, or payment instructions in generated PDFs.

Detection Guidance

Check BottleCRM invoice templates for suspicious HTML/CSS in fields like notes, terms, client name, or address. Inspect PDF generation logs for unsanitized user input. Review backend/invoices/pdf.py for render_invoice_template() function usage without html.escape().

Commands: grep -r "render_invoice_template" /path/to/bottleCRM/; grep -r "html.escape" /path/to/bottleCRM/; check PDF output for unexpected formatting or overlays.

Impact Analysis

This vulnerability could allow attackers to forge payment instructions or payee details in invoices, potentially leading to financial fraud. Users accessing public PDF links or emails may see manipulated invoice content, causing confusion or unauthorized transactions. The impact is limited to authenticated members with invoice creation permissions.

Compliance Impact

This vulnerability may impact compliance by enabling unauthorized data manipulation in invoices, which could lead to inaccurate financial records. For GDPR, this could affect data integrity requirements. For HIPAA, forged invoices might compromise transaction accuracy. However, specific compliance impacts depend on organizational policies and affected data.

Mitigation Strategies

Apply html.escape() to all user-supplied values in render_invoice_template() before substitution. Update to a patched version if available. Restrict invoice template access to trusted users only. Disable public PDF links until patched.

For SSRF/LFI risks, enforce strict URL validation in _allowed_pdf_url and use SafePdfURLFetcher for all PDF generation tasks.

Hi! I’m here to help you understand CVE-2026-110592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70