CVE-2026-110593: BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/createmail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated organization member can exploit it by submitting template tags in the AccountEmail message_body through the create_mail API endpoint. The affected endpoint is POST /api/accounts/<id>/create_mail/.
What impact can successful exploitation have?
An attacker can disclose the template rendering context and loaded Python modules. They can also block the shared Celery worker by supplying nested loops.
Which component processes the malicious input?
The send_email Celery task processes the supplied message body and compiles it with django.template.Template(). This means exploitation occurs when the email task renders the submitted content.