Template Injection in DjangoCRM's Massmail Module
CVE-2026-71239

8.8HIGH

Key Information:

Vendor

Djangocrm

Status
Django-crm
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71239?

The massmail module in DjangoCRM is susceptible to template injection due to the rendering of user-controlled EmlMessage fields without sanitization. In several instances, the subject and content fields are built directly into Django's Template() constructor, allowing attackers with edit rights to inject arbitrary Django template syntax. This serious flaw could facilitate unauthorized access to other users' personal data, password hashes, and allow CSRF token forgery, due to the manipulation of request context variables and the inclusion of registered templates.

Affected Version(s)

django-crm 0

References

https://github.com/DjangoCRM/django-crm

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mirdavlatov Mira'zam
.