CVE-2026-110593
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_b…
Published Oct 14, 2026 · updated Oct 14, 2026
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/ /create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/ /create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker
Oct 14, 2026 · NIST NVD
Updated
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/ /create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker
Sources
- CVE.orgVulnerability recordCVE-2026-110593
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-110593
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-110593
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /ap
nvd.nist.gov