EUVD-2026-22296
GHSA-j8gj-mw5g-642g
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
AnalysisAI
Remote code execution in Webkul Krayin CRM v2.2.x allows authenticated attackers with low-level privileges to upload and execute malicious PHP files through an unrestricted file upload vulnerability in the /admin/tinymce/upload endpoint. The scope change (CVSS S:C) indicates potential container escape or cross-tenant impact. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Krayin CRM v2.2.x instances in your environment and document affected systems; disable or restrict access to the /admin/tinymce/upload endpoint via WAF or reverse proxy rules. Within 7 days: Implement mandatory authentication verification and role-based access controls limiting upload functionality to administrative accounts only; audit file upload logs for suspicious activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today