PT-2026-32680 · Webkul · Krayin Crm

Trexnegro · Published 2026-04-14 · Updated 2026-04-22 · CVE-2026-38526

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webkul Krayin CRM versions 2.2.x

Description An authenticated arbitrary file upload issue exists in the '/admin/tinymce/upload' endpoint. This allows authenticated attackers to upload a crafted PHP file, which can lead to remote code execution and full system compromise. Approximately 2,700 services are estimated to be affected worldwide.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/admin/tinymce/upload' endpoint to minimize the risk of exploitation.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-38526

Affected Products

Krayin Crm

References · 11

• 🔥 https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md · Exploit
• 🔥 https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38526 · Security Note
• https://github.com/krayin/laravel-crm · Note
• https://twitter.com/HunterMapping/status/2045053297459867853 · Twitter Post
• https://twitter.com/DailyDarkWeb/status/2046500961464484201 · Twitter Post
• https://twitter.com/socradar/status/2046841318085988706 · Twitter Post
• https://twitter.com/CVEnew/status/2045972415348703435 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2046741679596835063 · Twitter Post
• https://twitter.com/NoctisIntel/status/2047006678353330389 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2044385465436926035 · Twitter Post