Threat database

BottleCRM versions 0.45 through 1.14.5 have a vulnerability in the _read_upload() function where the application reads entire CSV uploads before enforcing the 5 MB size limit. Authenticated users with mass-import permission can exploit this by sending oversized CSV files concurrently to specific import endpoints, causing excessive memory consumption and potential out-of-memory termination.

BottleCRM versions 0.43 through 1.14.5 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated organization administrators can create routing rules with complex regex patterns that cause catastrophic backtracking. This leads to exhaustion of web workers shared across all tenants when the _match_condition() function evaluates these patterns during case saves.

BottleCRM versions up to 1.14.5 contain a server-side template injection vulnerability in the send_email Celery task. Authenticated organization members can exploit this by submitting template tags via a specific API endpoint to disclose rendering context and loaded Python modules or cause denial of service by blocking the Celery worker with nested loops. The vulnerability has a medium severity with a CVSS score of 5.3.

BottleCRM versions 0.30 through 1.14.5 have an HTML injection vulnerability in the render_invoice_template() function. Authenticated organization members can inject HTML and CSS into invoice PDFs via fields such as notes, terms, client name, or address. This allows attackers to manipulate the visual content of PDFs delivered through downloads, public links, and emails.