Critical severity9.9NVD Advisory· Published Apr 14, 2026· Updated Apr 17, 2026

CVE-2026-38526

Description

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Krayin/Laravel CRMreferences
Webkul/Krayin CRMllm-fuzzy
Range: 2.2.x

Patches

Vulnerability mechanics

References

github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.mdnvd
github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526nvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000