CVE-2026-110592 MicroPyramid CVE debrief

Who should care

Defenders responsible for BottleCRM instances, particularly those with authenticated user access, should assess exposure and implement compensating controls to prevent potential abuse.

Why it matters

CVE-2026-110592 is an HTML injection vulnerability in BottleCRM that allows authenticated users to inject markup into custom-template invoice PDFs, potentially overlaying sensitive information and manipulating payment instructions.

• Potential overlay of sensitive information in generated PDFs
• Possible manipulation of payment instructions and totals
• Verification of PDF generation security controls is required
• Assessing feasibility of injecting malicious HTML and CSS is necessary

Technical summary

The vulnerability exists in the render_invoice_template() function of BottleCRM, allowing authenticated organization members to inject HTML and CSS into custom-template invoice PDFs. This can lead to potential overlay of sensitive information and manipulation of payment instructions in PDFs served via download, public links, and emails. Defenders should prioritize verifying exposure of BottleCRM instances to authenticated users, assessing the feasibility of injecting malicious HTML and CSS, and implementing compensating controls to monitor and restrict PDF generation.

Defensive priority

Defenders should prioritize verifying exposure of BottleCRM instances to authenticated users, assessing the feasibility of injecting malicious HTML and CSS, and implementing compensating controls to monitor and restrict PDF generation.

Recommended defensive actions

• Verify exposure of BottleCRM instances to authenticated users
• Assess the feasibility of injecting malicious HTML and CSS in PDFs
• Implement compensating controls to monitor and restrict PDF generation
• Restrict access to PDF generation and sensitive fields
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification from official sources. BottleCRM instances with authenticated user access should be assessed for exposure, and compensating controls should be implemented to prevent potential abuse. The render_invoice_template() function allows authenticated organization members to inject HTML and CSS into custom-template invoice PDFs, potentially overlaying sensitive information and manipulating pay

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.