Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110593— BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

Quick assessment

Affected
MicroPyramid BottleCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BottleCRM 1.14.5 及更早版本中存在一个服务端模板注入（SSTI）漏洞，该漏洞位于发送电子邮件的 Celery 任务中。此任务使用 对用户提供的 字段进行编译。已认证的组织成员可以通过向 接口提交模板标签，从而泄露渲染上下文和已加载的 Python 模块，或者通过嵌套循环阻塞共享的 Celery 工作进程。

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
MicroPyramid BottleCRM ≤ 1.14.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110593

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
Source: CVE Program / CVE List V5
Vulnerability Description
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MicroPyramid BottleCRM 0 ~ 1.14.5 -

II. Public POCs for CVE-2026-110593

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110593

请登录查看更多情报信息。

Other References for CVE-2026-110593 (3)

Same Patch Batch · MicroPyramid · 2026-10-14 · 4 CVEs total

CVE-2026-110594 4.9 MEDIUM BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
CVE-2026-110595 4.3 MEDIUM BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
CVE-2026-110592 3.5 LOW BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

IV. Related Vulnerabilities

Same product: BottleCRM
Same vendor: MicroPyramid
Same weakness: CWE-1336

V. Comments for CVE-2026-110593

No comments yet

Leave a comment