CyberRota Analysis
AI-GeneratedThe massmail module in DjangoCRM is vulnerable due to improper handling of user-controlled EmlMessage fields, allowing authenticated users with edit rights to inject malicious Django template syntax. This can lead to significant security risks, including unauthorized data disclosure, CSRF token forgery, and the potential execution of arbitrary templates. Organizations using DjangoCRM should prioritize patching this vulnerability to protect sensitive user data and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.