Vulnerability Description
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template() call; email_creators.py passes eml_message.subject directly as a template string to Template(); and helpers.py contains the same f-string interpolation pattern. An authenticated user with mass-mail message edit rights can inject Django template syntax ({{ }} / {% %}) that executes at render time, enabling disclosure of other users' data and password hashes via request context variables, CSRF token forgery, and inclusion of arbitrary registered templates.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-71239?
CVE-2026-71239 is a vulnerability with a CVSS score of 8.1 (HIGH). DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py ...
How severe is CVE-2026-71239?
CVE-2026-71239 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71239?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.