What is the CVSS score of CVE-2026-36340?

CVE-2026-36340 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Krayin CRM are affected by CVE-2026-36340?

Krayin CRM 2.1.5 contains a remote code execution vulnerability in the email composition feature that allows authenticated users to inject and execute arbitrary code on the server.. A patch is available.

How to fix or mitigate CVE-2026-36340?

Within 24 hours: Inventory all Krayin CRM deployments and identify instances running version 2.1.5 or earlier. Within 7 days: Upgrade to Krayin CRM 2.1.6 or later on all affected systems. If immediate upgrade is not feasible, restrict email compose functionality to administrators only and audit recent email composition activity for signs of misuse. Within 30 days: Conduct a full security review of CRM instances and implement network segmentation to limit CRM access to authorized personnel only.

Krayin CRM CVE-2026-36340

EUVD-2026-26382 HIGH

Code Injection (CWE-94)

2026-04-30 mitre

GHSA-32px-ccfx-cxq3

RCE Code Injection N A

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Apr 30, 2026 - 18:45 vuln.today

Analysis Generated

Apr 30, 2026 - 18:45 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

8.1 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 16:15 euvd

EUVD-2026-26382

Analysis Generated

Apr 30, 2026 - 16:15 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

HIGH 8.1

DescriptionCVE.org

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function

AnalysisAI

Remote code execution in Krayin CRM 2.1.5 allows authenticated attackers to execute arbitrary code through the compose email function via code injection. The vulnerability was patched in version 2.1.6 released by the vendor. A public proof-of-concept exploit exists on GitHub (cybercrewinc/CVE-2026-36340), significantly lowering the barrier to exploitation. With CVSS 8.1 (High) and network accessibility requiring only low-privilege authentication, this presents immediate risk to organizations running unpatched Krayin CRM instances, particularly those exposing the CRM to internal users or external partners.

Technical ContextAI

Krayin CRM is an open-source customer relationship management application built on Laravel framework. This vulnerability stems from CWE-94 (Improper Control of Generation of Code/Code Injection) affecting the email composition functionality. The flaw allows injection of executable code through user-controlled input in the compose email feature, which is then processed without adequate sanitization or validation. The Laravel-based architecture suggests the vulnerability may involve unsafe evaluation of user input during email template processing or SMTP configuration handling. Interestingly, the v2.1.6 release notes reference fixing a Cross-Site Scripting (XSS) vulnerability rather than explicitly mentioning RCE, suggesting either the vendor minimized the severity in public communications or the code injection can manifest as both XSS and RCE depending on exploitation context.

RemediationAI

Immediately upgrade to Krayin CRM version 2.1.6 or later from the official GitHub repository (https://github.com/krayin/laravel-crm/releases/tag/v2.1.6). The release specifically addresses this code injection vulnerability alongside XSS issues. Standard Laravel upgrade procedures should be followed including backing up the database, updating composer dependencies, and running database migrations. If immediate patching is not feasible, implement these compensating controls with noted limitations: restrict access to the compose email function through role-based access controls in Krayin settings (reduces attack surface but doesn't eliminate risk from compromised low-privilege accounts); deploy web application firewall rules to filter suspicious input patterns in email composition endpoints (may cause false positives and can be bypassed with encoding techniques); monitor application logs for unusual email composition activity or Laravel error logs indicating code execution attempts (detective control only, does not prevent exploitation). Network-level controls like limiting CRM access to trusted IP ranges reduce remote attack vectors but don't address insider threat scenarios. No compensating control fully mitigates CWE-94 code injection - patching remains the only complete solution.