Bottlecrm
Monthly
Uncontrolled memory allocation in BottleCRM 0.45 through 1.14.5 lets an authenticated user who also holds the application's 'mass-import' permission send oversized CSV files to the /api/contacts/import/ and /api/cases/import/ endpoints, causing worker processes to exhaust memory and terminate. The root cause is that the upload handler reads the entire file into memory before enforcing the intended 5 MB limit, so a single oversized file or, more effectively, several concurrent oversized files can outpace memory reclamation and trigger out-of-memory kills. Impact is availability-only (worker crashes, degraded or interrupted import and request handling) with no data exposure or modification; exploitation is gated by the privileged mass-import permission, no public exploit code has been identified, and no vendor-released patch was identified at time of analysis. This is a medium-severity denial-of-service issue rather than an urgent priority, and it is not confirmed actively exploited (no CISA KEV listing).
Case routing rule conditions in BottleCRM 0.43 through 1.14.5 accept unbounded regular expressions that are evaluated by _match_condition() every time a case is saved, so an authenticated organization administrator can insert a catastrophically backtracking pattern and pin or exhaust Django web workers, producing a denial of service. Because those worker processes are shared across all tenants on a deployment, the impact of one organization's admin reaches unrelated customers, which is why the assessed CVSS 3.1 vector marks scope as changed (S:C) with high availability impact and no confidentiality or integrity loss. Exploitation requires a high-privilege authenticated account (PR:H, organization administrator able to create routing rules) and the routing-rules feature being in active use, but needs no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the 6.9 base score places this as a moderate, availability-only risk.
Server-side template injection in BottleCRM (Django-CRM) through 1.14.5 allows an authenticated member of an organization to have attacker-controlled text compiled as a Django template by the send_email Celery task, exposing the template rendering context and the Python modules loaded in the worker, or tying up the shared worker with nested loops. The flaw is reachable remotely without any victim interaction through POST /api/accounts/<id>/create_mail/ by supplying a crafted AccountEmail message_body, and it requires a valid account that belongs to the target organization (the CVSS vector specifies PR:L). Because the sink is django.template.Template() rather than Jinja2, the assessed impact is confined to tenant-scoped information disclosure and denial of service against the shared Celery worker, with no public exploit identified at time of analysis and no confirmed path to arbitrary code execution.
HTML injection in BottleCRM 0.30 through 1.14.5 lets an authenticated organization member embed arbitrary markup and CSS into customized invoice PDFs by writing HTML into the notes, terms, client name, or client address fields that render_invoice_template() processes. The injected content can visually overlay totals, payee details, and payment instructions in the resulting PDF, which is then viewed by a victim through a direct download, a public link, or an email attachment (CVSS 4.0 base 5.1; assessed 3.1 vector AV:N/AC:L/PR:L/UI:R, integrity-only with low impact). Exploitation requires the deployment to actually use a custom invoice template and requires a victim to open the rendered document, making this a fraud-oriented, low-to-medium priority issue rather than automatic server-side compromise, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Uncontrolled memory allocation in BottleCRM 0.45 through 1.14.5 lets an authenticated user who also holds the application's 'mass-import' permission send oversized CSV files to the /api/contacts/import/ and /api/cases/import/ endpoints, causing worker processes to exhaust memory and terminate. The root cause is that the upload handler reads the entire file into memory before enforcing the intended 5 MB limit, so a single oversized file or, more effectively, several concurrent oversized files can outpace memory reclamation and trigger out-of-memory kills. Impact is availability-only (worker crashes, degraded or interrupted import and request handling) with no data exposure or modification; exploitation is gated by the privileged mass-import permission, no public exploit code has been identified, and no vendor-released patch was identified at time of analysis. This is a medium-severity denial-of-service issue rather than an urgent priority, and it is not confirmed actively exploited (no CISA KEV listing).
Case routing rule conditions in BottleCRM 0.43 through 1.14.5 accept unbounded regular expressions that are evaluated by _match_condition() every time a case is saved, so an authenticated organization administrator can insert a catastrophically backtracking pattern and pin or exhaust Django web workers, producing a denial of service. Because those worker processes are shared across all tenants on a deployment, the impact of one organization's admin reaches unrelated customers, which is why the assessed CVSS 3.1 vector marks scope as changed (S:C) with high availability impact and no confidentiality or integrity loss. Exploitation requires a high-privilege authenticated account (PR:H, organization administrator able to create routing rules) and the routing-rules feature being in active use, but needs no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the 6.9 base score places this as a moderate, availability-only risk.
Server-side template injection in BottleCRM (Django-CRM) through 1.14.5 allows an authenticated member of an organization to have attacker-controlled text compiled as a Django template by the send_email Celery task, exposing the template rendering context and the Python modules loaded in the worker, or tying up the shared worker with nested loops. The flaw is reachable remotely without any victim interaction through POST /api/accounts/<id>/create_mail/ by supplying a crafted AccountEmail message_body, and it requires a valid account that belongs to the target organization (the CVSS vector specifies PR:L). Because the sink is django.template.Template() rather than Jinja2, the assessed impact is confined to tenant-scoped information disclosure and denial of service against the shared Celery worker, with no public exploit identified at time of analysis and no confirmed path to arbitrary code execution.
HTML injection in BottleCRM 0.30 through 1.14.5 lets an authenticated organization member embed arbitrary markup and CSS into customized invoice PDFs by writing HTML into the notes, terms, client name, or client address fields that render_invoice_template() processes. The injected content can visually overlay totals, payee details, and payment instructions in the resulting PDF, which is then viewed by a victim through a direct download, a public link, or an email attachment (CVSS 4.0 base 5.1; assessed 3.1 vector AV:N/AC:L/PR:L/UI:R, integrity-only with low impact). Exploitation requires the deployment to actually use a custom invoice template and requires a victim to open the rendered document, making this a fraud-oriented, low-to-medium priority issue rather than automatic server-side compromise, and no public exploit code or confirmed active exploitation was identified at time of analysis.