CVE-2026-110592

CVSS 5.1 (medium) · published 2026-10-14

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.

Weakness: CWE-116

Source: NVD CVE-2026-110592

References

• https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/invoices/pdf.py#L660-L712
• https://github.com/Django-CRM/Django-CRM/issues/825
• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110592
• https://www.vulncheck.com/advisories/bottlecrm-0.30-through-1.14.5-html-injection-via-custom-invoice-pdf-template
• https://github.com/Django-CRM/Django-CRM/issues/825

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.