CVE-2026-110592: Improper Encoding or Escaping of Output in MicroPyramid BottleCRM

CVE-2026-110592 is an HTML injection vulnerability in MicroPyramid's BottleCRM affecting versions 0.30 through 1.14.5. The flaw exists in the render_invoice_template() function, allowing authenticated users to inject arbitrary HTML and CSS into custom invoice PDFs. This injection can manipulate the visual content of invoices, including overlaying totals, payee information, and payment instructions. The vulnerability requires authenticated access with organization member privileges and impacts invoice PDFs served via multiple delivery methods.

An attacker with authenticated organization member access can inject malicious HTML and CSS into invoice PDFs, potentially misleading recipients by altering invoice content such as totals and payment instructions. This could lead to confusion or fraudulent payment redirection. However, the vulnerability does not allow privilege escalation or remote code execution. The CVSS 4.0 base score is 5.1, indicating medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted individuals and review invoice templates and input fields for suspicious markup. Avoid using untrusted input in invoice PDFs.