Read the docs
TI-2026-74086 Aliases CVE-2026-110592GHSA-mpf8-4qc8-mc43

HTML injection in BottleCRM invoice PDF templates

Priority MEDIUM 56CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

BottleCRM from 0.30 through 1.14.5 does not escape output in render_invoice_template(), so markup in custom invoice PDF templates is not neutralized (CWE-116). An authenticated organization member can place HTML and CSS in notes, terms, client name or address fields. The injected markup can overlay totals, payee details and payment instructions in PDFs delivered by download, public links and email. A link to an exploit is in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicroPyramidBottleCRM0.30 – 1.14.5—No fix listedCNA
  • BottleCRM VendorMicroPyramid Affected 0.30 – 1.14.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for BottleCRM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110592
  2. 2026-10-14 Alias added: GHSA-mpf8-4qc8-mc43
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: LOW → MEDIUM
  5. 2026-10-16 1 new reference · CNA

References

Exploit 1

Other 2

  • TI-2026-74088 ReDoS in BottleCRM case routing rule regex CVSS 4.0MEDIUM 6.9
  • TI-2026-74089 Memory exhaustion in BottleCRM via contact and case CSV import CVSS 4.0MEDIUM 5.3
  • TI-2019-08552 Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via… CVSS 3.0HIGH 8.8
  • TI-2018-11872 MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. CVSS 3.1HIGH 8.8
  • TI-2026-74087 Server-side template injection in BottleCRM via account email CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences