MEDIUMCVSS 5.3
CVE-2026-110593
CVE-2026-110593 updated by NVD
Summary
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/ /create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
References
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.