PT-2026-32680 · Webkul · Krayin Crm

Trexnegro · CVE-2026-38526 · Published 2026-04-14 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Krayin CRM versions 2.2.x and earlier

Description An authenticated arbitrary file upload flaw exists in the /admin/tinymce/upload endpoint. This issue allows an authenticated attacker to upload a crafted PHP file, leading to remote code execution (RCE) and potential full system compromise. The flaw is associated with the TinyMCE upload component. Approximately 2,700 services have been identified as potentially exposed.

Recommendations Restrict access to the admin panel to minimize the risk of exploitation. Mitigate script execution within the upload paths. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

LPE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-38526

Affected Products

Krayin Crm

References · 18

• 🔥 https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526 · Exploit
• 🔥 https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md · Exploit
• 🔥 https://exploit-db.com/exploits/52629 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38526 · Security Note
• https://github.com/krayin/laravel-crm · Note
• https://twitter.com/DarkWebInformer/status/2077173816543842480 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2070294865594699818 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2046741679596835063 · Twitter Post
• https://twitter.com/HunterMapping/status/2045053297459867853 · Twitter Post
• https://twitter.com/NoctisIntel/status/2047006678353330389 · Twitter Post
• https://twitter.com/lyrie_ai/status/2077936582217081028 · Twitter Post
• https://t.me/proxy_bar/3509 · Telegram Post
• https://twitter.com/DailyDarkWeb/status/2046500961464484201 · Twitter Post
• https://twitter.com/hacck3y/status/2073314347036930169 · Twitter Post
• https://twitter.com/socradar/status/2046841318085988706 · Twitter Post