CVE-2026-110593 Details

A server-side template injection vulnerability has been identified in BottleCRM versions through 1.14.5. This vulnerability exists within the 'send_email' Celery task, where user-supplied content in the 'message_body' of 'AccountEmail' is processed using Django's template engine. Authenticated organization members can exploit this by sending template tags through a specific API endpoint, which can lead to unauthorized disclosure of the rendering context and loaded Python modules. Additionally, this exploitation can disrupt the shared Celery worker by causing CPU exhaustion through nested loops.

Replace Django's 'Template' engine with a safer rendering method that only allows known safe placeholders, such as '{{ name }}' and '{{ email }}'. This can be done by creating a custom function that substitutes these placeholders with escaped values, stripping away any remaining template syntax before the email is sent.