{"id":"CVE-2026-38526","aliases":["EUVD-2026-22296","GHSA-j8gj-mw5g-642g"],"status":"published","title":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of...","description":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0412,"percentile":0.9088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2026-04-14T00:00:00Z","modified":"2026-06-17T10:41:42Z","exploits":[{"source":"pocgithub","id":"NathanHimself/CVE-2026-38526-PoC","title":"NathanHimself/CVE-2026-38526-PoC","date":"2026-05-16","url":"https://github.com/NathanHimself/CVE-2026-38526-PoC"},{"source":"pocgithub","id":"pawpic/CVE-2026-38526-POC","title":"pawpic/CVE-2026-38526-POC","date":"2026-06-24","url":"https://github.com/pawpic/CVE-2026-38526-POC"},{"source":"pocgithub","id":"diamorphine666/CVE-2026-38526-Exploit","title":"diamorphine666/CVE-2026-38526-Exploit","date":"2026-07-06","url":"https://github.com/diamorphine666/CVE-2026-38526-Exploit"},{"source":"pocgithub","id":"mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report","title":"mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report","date":"2026-07-06","url":"https://github.com/mmoobbeeiidat-design/Hack-The-Box-Nexus-Findings-Report"},{"source":"exploitdb","id":"EDB-52629","title":"Krayin CRM v2.2.x - Authenticated Remote Code Execution","type":"webapps","platform":"multiple","date":"2026-07-08","url":"https://www.exploit-db.com/exploits/52629"},{"source":"pocgithub","id":"b0nyo/PoC-CVE-2026-38526","title":"b0nyo/PoC-CVE-2026-38526","date":"2026-07-08","url":"https://github.com/b0nyo/PoC-CVE-2026-38526"},{"source":"pocgithub","id":"Resolvdd/CVE-2026-38526-PoC-htb-nexus","title":"Resolvdd/CVE-2026-38526-PoC-htb-nexus","date":"2026-07-11","url":"https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus"},{"source":"pocgithub","id":"CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526","title":"CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526","date":"2026-07-13","url":"https://github.com/CerberusMrXi/KrayinCRM-RCE-Exploit-CVE-2026-38526"},{"source":"pocgithub","id":"Qurclinc/CVE-2026-38526","title":"Qurclinc/CVE-2026-38526","date":"2026-07-13","url":"https://github.com/Qurclinc/CVE-2026-38526"},{"source":"pocgithub","id":"Shirouuu/Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-","title":"Shirouuu/Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-","date":"2026-09-14","url":"https://github.com/Shirouuu/Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-"},{"source":"pocgithub","id":"Ish3ng0m4/CVE-2026-38526-KrayinCRM","title":"Ish3ng0m4/CVE-2026-38526-KrayinCRM","date":"2026-09-15","url":"https://github.com/Ish3ng0m4/CVE-2026-38526-KrayinCRM"},{"source":"pocgithub","id":"Wingleszy/HTB-Nexus-walkthrough","title":"Wingleszy/HTB-Nexus-walkthrough","date":"2026-09-24","url":"https://github.com/Wingleszy/HTB-Nexus-walkthrough"},{"source":"pocgithub","id":"Harry178945/CVE-2026-38526","title":"Harry178945/CVE-2026-38526","date":"2026-09-28","url":"https://github.com/Harry178945/CVE-2026-38526"},{"source":"pocgithub","id":"Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE","title":"Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE","date":"2026-10-16","url":"https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-38526-KrayinCRM-RCE"},{"source":"pocgithub","id":"sh3llc0d3-0x15/CVE-2026-38526-Exploit","title":"sh3llc0d3-0x15/CVE-2026-38526-Exploit","date":"2026-10-24","url":"https://github.com/sh3llc0d3-0x15/CVE-2026-38526-Exploit"}],"references":[{"url":"https://github.com/krayin/laravel-crm"},{"url":"https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526"},{"url":"https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38526"},{"url":"https://github.com/advisories/GHSA-j8gj-mw5g-642g"}],"sources":{"cve":[{"id":"CVE-2026-38526","description":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-04-14T17:50:54.198Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-22296","description":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-04-14T17:50:54Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-02T19:24:25.607055Z"}],"ghsa":[{"id":"GHSA-j8gj-mw5g-642g","title":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of...","description":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.","status":"published","published":"2026-04-14T18:30:35Z","modified":"2026-04-14T18:30:41Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:07:29.002055Z"}],"nvd":[{"id":"CVE-2026-38526","description":"An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.","status":"published","published":"2026-04-14T16:16:43.127Z","modified":"2026-06-17T10:41:42.487Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:14.37744Z"}]}}