Description
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MicroPyramid BottleCRM
Default version status: unaffected
0 to ≤ 1.14.5affected
pkg:pypi/django-crmReferences
- https://github.com/Django-CRM/Django-CRM/issues/826 ↗
- https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/accounts/tasks.py#L45 ↗
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110593 ↗
- https://www.vulncheck.com/advisories/bottlecrm-through-1.14.5-server-side-template-injection-via-account-email-create-mail ↗