What is the CVSS score of CVE-2026-38526?

CVE-2026-38526 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-38526?

Webkul Krayin CRM v2.2.x contains a critical remote code execution vulnerability that allows authenticated users with low-level privileges to upload and execute malicious PHP files, potentially…

Is there a public PoC exploit available for CVE-2026-38526?

Yes, a public proof-of-concept exploit is available for CVE-2026-38526. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-38526?

Within 24 hours: Identify all Krayin CRM v2.2.x instances in your environment and document affected systems; disable or restrict access to the /admin/tinymce/upload endpoint via WAF or reverse proxy rules. Within 7 days: Implement mandatory authentication verification and role-based access controls limiting upload functionality to administrative accounts only; audit file upload logs for suspicious activity. Within 30 days: Contact Webkul for patch availability timeline; evaluate migration to a patched version or alternative CRM solution if no patch is released; implement file type whitelisting and disable PHP execution in upload directories.

PHP CVE-2026-38526

EUVD-2026-22296 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-14 mitre

GHSA-j8gj-mw5g-642g

File Upload PHP RCE

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22296

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

CRITICAL 9.9

DescriptionCVE.org

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

AnalysisAI

Remote code execution in Webkul Krayin CRM v2.2.x allows authenticated attackers with low-level privileges to upload and execute malicious PHP files through an unrestricted file upload vulnerability in the /admin/tinymce/upload endpoint. The scope change (CVSS S:C) indicates potential container escape or cross-tenant impact. Authentication requirement confirmed (CVSS PR:L). No public exploit identified at time of analysis, though technical details are available in security advisory references.

Technical ContextAI

Krayin CRM is a Laravel-based customer relationship management application developed by Webkul. The vulnerability resides in the TinyMCE integration endpoint at /admin/tinymce/upload, which is a rich text editor file upload handler. This endpoint fails to implement proper file type validation, MIME type verification, or extension whitelisting, allowing authenticated users to bypass upload restrictions. The lack of server-side validation combined with direct file execution capabilities in PHP environments creates a classical unrestricted file upload (often mapped to CWE-434) leading to remote code execution. The /admin/ path prefix suggests this is within the administrative interface, yet only low-privilege authentication (PR:L) is required, indicating insufficient role-based access controls. The Laravel framework typically provides upload validation mechanisms through Request validation and Storage facades, suggesting these protections were either not implemented or improperly configured in this endpoint.

RemediationAI

Organizations should immediately upgrade to a patched version of Krayin CRM if available by consulting the official Webkul Krayin repository at https://github.com/krayin/laravel-crm for security updates addressing CVE-2026-38526. Review the security advisory at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526 for specific remediation guidance from the reporting researcher. As interim mitigations while awaiting patches, implement strict file upload validation at the application layer including extension whitelisting (allowing only image formats if TinyMCE is used for rich text editing), MIME type verification server-side, and file content inspection. Configure web server rules to prevent execution of PHP files in upload directories using .htaccess deny rules or nginx location blocks. Restrict access to /admin/tinymce/upload endpoint through additional authentication layers or role-based access controls limiting access to trusted administrative users only. Deploy web application firewall rules to detect and block suspicious file upload attempts. Conduct audit of existing uploaded files in TinyMCE directories for potentially malicious PHP scripts.