CVE-2026-71239 in django-crm
Summary
by MITRE • 08/05/2026
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template() call; email_creators.py passes eml_message.subject directly as a template string to Template(); and helpers.py contains the same f-string interpolation pattern. An authenticated user with mass-mail message edit rights can inject Django template syntax ({{ }} / {% %}) that executes at render time, enabling disclosure of other users' data and password hashes via request context variables, CSRF token forgery, and inclusion of arbitrary registered templates.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within DjangoCRM's massmail module where user-controlled email message fields are directly processed through Django's Template() constructor without proper sanitization or validation. The flaw manifests across multiple files including message_previews.py, email_creators.py, and helpers.py where EmlMessage subject and content fields are embedded into template constructs using f-string interpolation patterns that bypass security controls. The vulnerability stems from inadequate input validation and improper template handling practices that allow authenticated users with mass-mail message edit privileges to inject malicious Django template syntax directly into the rendering pipeline. This creates a critical server-side template injection vulnerability that can be exploited to execute arbitrary code within the context of the application's template engine, as demonstrated by the direct embedding of user-supplied data into Template() constructor calls without proper sanitization.
The technical impact of this vulnerability extends beyond simple information disclosure to encompass full privilege escalation capabilities through the exploitation of Django's template system. Attackers can leverage this vulnerability to access sensitive data from other users' sessions, extract password hashes stored in request context variables, forge CSRF tokens, and potentially include arbitrary registered templates that could execute additional malicious operations. The vulnerability operates at the application layer and can be exploited by authenticated users who possess edit rights for mass-mail messages, making it particularly dangerous within environments where administrative privileges are shared among multiple users. This type of vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and falls under ATT&CK technique T1059.006 (Command and Scripting Interpreter: Python) when exploited for code execution.
The operational impact of this vulnerability represents a severe risk to organizational security posture, particularly in environments where DjangoCRM is used for email communications and user management. An attacker with access to mass-mail message editing capabilities can systematically extract sensitive information from the application's memory space, potentially compromising entire user bases through session hijacking or credential theft. The vulnerability's exploitation requires only basic knowledge of Django template syntax and authentication access, making it particularly dangerous as it can be leveraged by both internal and external threat actors who gain legitimate access to the system. Organizations using this software should immediately implement mitigation strategies including input sanitization, template validation, and privilege restrictions for mass-mail functionality.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities from occurring in the future. The primary fix involves implementing comprehensive input sanitization for all user-controlled fields that will be processed through Django's Template() constructor, including proper escaping of special characters and validation against known malicious patterns. Organizations should also implement strict template context restrictions that limit access to sensitive variables within email rendering processes, ensuring that only authorized data can be accessed during template execution. Additionally, privilege controls must be enforced to restrict mass-mail message editing capabilities to only essential administrators, reducing the attack surface for this particular vulnerability. The implementation of secure coding practices including proper template handling and input validation should be integrated into all development lifecycle processes to prevent similar issues from recurring in future releases.