CVE-2026-110592: medium-severity vulnerability in MicroPyramid BottleCRM
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.1epss 0.4%
exploitation probability
0.4%top 70% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
MicroPyramid · BottleCRMpublic PoCs found — 1
cve_referencegithub.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110592unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MicroPyramid BottleCRM
In the same product, most dangerous first.
CVE-2026-110594MEDIUMBottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule RegexEPSS 0.6%CVE-2026-110595MEDIUMBottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV ImportEPSS 0.5%CVE-2026-110593MEDIUMBottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mailEPSS 0.4%
References
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110592https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/invoices/pdf.py#L660-L712https://github.com/Django-CRM/Django-CRM/issues/825https://www.vulncheck.com/advisories/bottlecrm-0.30-through-1.14.5-html-injection-via-custom-invoice-pdf-template