Krayin CRM EUVD-2026-87290

Requires an authenticated account with access to the TinyMCE media-upload feature of Krayin laravel-crm (versions up to and including 2.2.5), plus a second user who subsequently views the uploaded content for the stored payload to fire. The specific trigger is uploading an SVG file under a non-SVG filename (e.g., payload.png): the stored extension is derived from file content and served as SVG, while the name-based sanitizer check is skipped. A related nested-configuration-field upload path also stored files without SVG sanitization. Limiting factors: low-privilege authentication is needed (PR:L), passive victim interaction is required (UI:P), and impact is confined to script execution in the victim's browser context rather than server compromise.

This is a genuine but low-priority stored XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, score 5.1 Medium) tells a consistent, self-limiting story: network-reachable but requiring low-privilege authentication (PR:L) to upload content and passive victim interaction (UI:P) to trigger, with only limited integrity impact and no direct confidentiality or availability impact per the vendor scoring. The source-code evidence clarifies the real bug - the TinyMCE media-upload SVG sanitizer was bypassed when an SVG was uploaded under a non-SVG filename, so the stored payload is served as an executable SVG. No EPSS score, no CISA KEV listing, and no formal POC flag are present in the input, so there is no signal of active exploitation or automated weaponization. A third-party technical advisory (carlosalbertotuma/advisory-03) documents the technique, which raises the practical ease of reproduction, but this is a write-up rather than a confirmed exploit-code artifact. Note one discrepancy for defenders: the vendor sets VC:N (no confidentiality impact), yet stored XSS in an authenticated CRM can realistically read session/DOM data of a viewing user - I would rate confidentiality at low rather than none. Overall this is a real defect worth patching but not an emergency: authentication plus victim interaction gate it, and the affected product has a small footprint.

A low-privileged authenticated CRM user uploads a malicious SVG through the TinyMCE media uploader, naming it with a benign extension like payload.png so the filename-based SVG check is skipped; the file is stored and later served as an SVG. When another user (e.g., an agent or administrator) views the content, the embedded script executes in their browser session. A public third-party advisory describes the SVG-filename bypass technique, though no formal exploit-code POC is flagged in the input.