Home / Vulnerability Intelligence / CVE-2026-38526

CVE-2026-38526 - Vulnerability Analysis

CriticalCVSS: 9.9

Last Updated: April 14, 2026

Webkul Krayin CRM - Arbitrary File Upload

Published: April 14, 2026Updated: April 14, 2026Remote Exploitable

Overview

Webkul Krayin CRM v2.2.x contains an arbitrary file upload vulnerability caused by insufficient validation in /admin/tinymce/upload endpoint, letting authenticated attackers execute arbitrary code via crafted PHP files.

Severity & Score

Severity: Critical

CVSS Score: 9.9

Impact

Authenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version that patches this vulnerability.

References

https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526
https://github.com/krayin/laravel-crm
https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-38526
Severity: Critical
CVSS Score: 9.9
Type: unrestricted_file_upload
Status: new

CWE

CWE-434

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H