CVE-2026-110593

Deferred Deferred - Pending Action

Server-Side Template Injection in BottleCRM

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110593

EUVD

EUVD-2026-101221

Affected Vendors & Products

Vendor	Product	Version / Range
MicroPyramid	BottleCRM	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This is a server-side template injection (SSTI) vulnerability in BottleCRM versions up to 1.14.5. It occurs in the send_email Celery task where user-supplied input in the message_body parameter is processed using Django's template engine. Authenticated organization members can inject malicious template tags via a POST request to /api/accounts/<id>/create_mail/. This allows attackers to disclose internal context, loaded Python modules, or disrupt the Celery worker with nested loops causing potential Denial-of-Service.

Detection Guidance

Check BottleCRM logs for POST requests to /api/accounts/<id>/create_mail/ with unusual message_body parameters containing template tags like {% debug %} or {% widthratio %}. Monitor Celery worker logs for blocked tasks or CPU spikes from nested loops.

Impact Analysis

An attacker with organization access could steal sensitive data by leaking internal context or Python modules. They could also cause system slowdowns or crashes by triggering CPU-intensive nested loops in the Celery worker, disrupting email processing for all users. Additionally, the attack surface expands as attackers can import arbitrary template tags to perform unintended operations.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. The potential for information leakage and system disruption may result in compliance violations, regulatory penalties, and loss of trust in systems handling sensitive personal or health data.

Mitigation Strategies

Upgrade BottleCRM to a patched version that replaces Django's Template engine with safe placeholder substitution in message_body.
Review and sanitize all existing message_body entries in the database to remove template syntax.
Restrict access to the /api/accounts/<id>/create_mail/ endpoint to authorized users only.

Hi! I’m here to help you understand CVE-2026-110593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70