Low severity · published Oct 14, 2026
CVE-2026-110592
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
3.5
CVSS
0.4%
EPSS
No
On KEV
Description
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
BottleCRM · MicroPyramid
0.30 through 1.14.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110592
issue-tracking
https://github.com/Django-CRM/Django-CRM/issues/825
technical-description
https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/invoices/pdf.py#L660-L712
technical-description
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110592
third-party-advisory
https://www.vulncheck.com/advisories/bottlecrm-0.30-through-1.14.5-html-injection-via-custom-invoice-pdf-template
More from BottleCRM
5.4
CVE-2026-110593
BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
4.9
CVE-2026-110594
BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
4.3
CVE-2026-110595
BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import