CVE-2026-110592: BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
Affected Software
Event History
Frequently Asked Questions
Which deployments are within the reported affected version range?
The reported affected range is BottleCRM 0.30 through 1.14.5. The issue is specifically associated with custom invoice PDF templates.
What access does an attacker need to exploit this issue?
An attacker must be an authenticated organization member. They must be able to supply content in invoice fields such as notes, terms, client name, or address fields.
How might recipients encounter a manipulated invoice?
Manipulated PDFs may be delivered through direct downloads, public links, or email. The injected HTML and CSS can be used to overlay displayed totals, payee details, and payment instructions.
Is there evidence that the standard invoice template is affected?
The available information identifies custom-template invoice PDFs as affected. It does not state that standard invoice templates are vulnerable.