CVE-2026-110595 is a medium-severity vulnerability in BottleCRM versions 0.45 through 1.14.5. An authenticated user with mass-import permission can cause a denial of service by uploading large CSV files to /api/contacts/import/ and /api/cases/import/ endpoints, leading to out-of-memory termination. The vulnerability is caused by uncontrolled memory allocation in the _read_upload() function, which reads en [truncated]
Authenticated organization administrators using BottleCRM versions 0.43 through 1.14.5 should assess exposure to a regular expression denial of service vulnerability. The vulnerability allows administrators to block web workers via unbounded routing rule regex patterns. To verify exposure and prioritize remediation, defenders should review routing rule configurations and assess worker exhaustion risks.
CVE-2026-110593 debrief based on the supplied source corpus. BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task. Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops. Defenders should [truncated]
CVE-2026-110592 is an HTML injection vulnerability in BottleCRM 0.30 through 1.14.5 that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
