EUVD-2026-87281Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CRM admin/config panel
-
DeliveryUpload malicious SVG in image/logo field
-
ExploitBypass mime filter (svg allowed)
-
ExecutionStore XSS payload
-
PersistVictim opens page rendering SVG
-
ImpactScript executes in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with access to the Krayin laravel-crm configuration/settings panel that exposes file-upload fields (logo, favicon, and similar image settings) on versions up to 2.2.5, where the server-side mime allowlist accepted 'svg'. The attacker uploads an SVG containing embedded script; exploitation additionally requires a victim to subsequently view a page that renders the uploaded SVG inline (UI:P). Limiting factors: authenticated access is mandatory (PR:L), victim interaction is required, and the issue is fixed in 2.2.6 by dropping svg from the allowed mimes and resolving validation only from trusted server-side config. |
| Impact | This is a low-severity, low-priority issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields only 2.0, and the E:P (Proof-of-Concept) exploit maturity aligns with the reported 'publicly available' exploit - a written advisory exists at carlosalbertotuma/advisory. However, the vulnerability is doubly gated: PR:L means the attacker must already be authenticated to the CRM's configuration/admin area to upload the file, and UI:P means a victim must view the rendered content for the stored SVG script to fire. There is no CISA KEV listing and no EPSS score provided, so exploitation status is limited to 'publicly available exploit code exists' - this is NOT evidence of active in-the-wild exploitation. The signals are internally consistent (low CVSS, PoC-only maturity, authenticated precondition), so this is a genuinely low-real-risk issue rather than a high-CVSS false alarm. The source-code evidence confirms the root cause precisely: core_config.php allowed 'svg' in the upload mime allowlist, and SVG files can carry embedded JavaScript, producing stored XSS. Note the CVSS impact metrics slightly understate the flaw - a stored XSS realistically affects confidentiality of session/DOM data (VC:L), not only integrity. |
| Exploit ScenarioDerived | An authenticated user with access to the CRM configuration panel uploads a crafted SVG file (e.g., as a logo or favicon) containing embedded JavaScript, which older versions accepted because 'svg' was in the mime allowlist. When another user - such as an administrator or agent - loads a page that renders the uploaded image inline, the embedded script executes in their browser session. A public advisory and PoC for this exact configuration-upload XSS are available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configuration/settings panel upload a crafted SVG image containing embedded script that executes when a victim later views the rendered file. Exploitation requires a valid account with configuration access plus victim interaction (the victim must view a page that renders the uploaded SVG inline), which keeps this a low-severity, low-priority issue even though it is remotely reachable; publicly available exploit code exists, and there is no confirmation of active exploitation. The vendor resolved the flaw in 2.2.6 by removing SVG from the upload mime allowlist and resolving validation rules only from trusted server-side configuration.
RemediationAI
Vendor-released patch: Krayin Laravel CRM 2.2.6, available at https://github.com/krayin/laravel-crm/releases/tag/v2.2.6 and via the fix commit b9836530ec9f5ef0f51653bb0cbbc47ef7184f51 (PR https://github.com/krayin/laravel-crm/pull/2620); upgrade affected instances to 2.2.6 or later. If an immediate upgrade is not possible, the surgical workaround is to edit packages/Webkul/Admin/src/Config/core_config.php and remove svg from the two mimes allowlists ('mimes:bmp,jpeg,jpg,png,webp,svg' and 'mimes:ico,jpeg,jpg,png,webp,svg' become 'mimes:bmp,jpeg,jpg,png,webp' and 'mimes:ico,jpeg,jpg,png,webp'), accepting the side effect that legitimate SVG logo/favicon uploads will be rejected; because the underlying flaw also lets a client-supplied keys[] payload relax validation, ensure validation rules are only ever loaded from trusted server-side configuration rather than request input. As defense in depth, restrict access to the admin configuration/settings panel to trusted administrators so the PR:L prerequisite cannot be met by lower-privileged users, and serve user-uploaded images with a Content-Disposition of attachment and/or a restrictive Content-Security-Policy so stored SVG files are not rendered inline in a privileged session - noting that these controls reduce but do not eliminate the risk if an attacker already holds settings access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin is an open-source CRM built on the Laravel framework, and the affected code lives in the admin package at packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php, which builds validation rules for configuration form submissions (logo, favicon, and similar image settings). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), here manifesting as unrestricted/attacker-influenced file-type validation: the rules() method derived its rule set from the client-supplied keys[] payload and fell back to 'nullable' for unknown keys, allowing an attacker to relax an upload rule, while core_config.php additionally listed svg in its mimes allowlist ('mimes:bmp,jpeg,jpg,png,webp,svg' and 'mimes:ico,jpeg,jpg,png,webp,svg'). Because SVG is an XML format that can embed <script> and event handlers, an uploaded malicious SVG is stored by the application and executes in the browser context of any user who renders it inline. The upstream fix (PR #2620, commit b9836530ec9f5ef0f51653bb0cbbc47ef7184f51) removes svg from both mime allowlists and reworks rules() to resolve validation exclusively from trusted server-side configuration, rejecting any uploaded file whose key is not a registered configuration field with a 'prohibited' rule.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated config-panel upload (PR:L) and victim must view rendered SVG (UI:R); stored XSS crosses into the victim browser context (S:C) with limited confidentiality/integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB