CVE-2026-71239

Name of the Vulnerable Software and Affected Versions DjangoCRM (affected versions not specified)

Description The massmail module fails to sanitize user-controlled EmlMessage fields, specifically subject and content, when rendering them through the Django Template() constructor. This issue occurs in message previews.py, email creators.py, and helpers.py. An authenticated user with mass-mail message edit rights can perform Server-Side Template Injection (SSTI) by injecting Django template syntax. This can lead to the disclosure of password hashes and other users' data via request context variables, CSRF token forgery, and the inclusion of arbitrary registered templates.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.