CVE-2026-38526
Published: 14 April 2026
Summary
CVE-2026-38526 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents arbitrary file uploads by validating file types and content at the /admin/tinymce/upload endpoint to block crafted PHP files.
Restricts the upload endpoint to only safe file types, excluding dangerous PHP files and mitigating CWE-434 unrestricted uploads.
Remediates the specific flaw in Webkul Krayin CRM v2.2.x upload endpoint through timely patching to eliminate the arbitrary code execution vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The authenticated arbitrary PHP file upload vulnerability in a public-facing web app directly enables exploitation of the application for initial access (T1190) and facilitates web shell installation for code execution (T1100, T1505.003).
NVD Description
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Deeper analysisAI
CVE-2026-38526 is an authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x. This issue, linked to CWE-434 (Unrestricted Upload of File with Dangerous Type), allows attackers to upload crafted PHP files, resulting in arbitrary code execution. Published on 2026-04-14, it carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe.
An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By uploading a malicious PHP file through the affected endpoint, the attacker achieves arbitrary code execution, leading to high-impact compromise of confidentiality, integrity, and availability, with a changed scope that amplifies the effects across the system.
Advisories and a proof-of-concept exploit are documented in the GitHub repository https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38526, with the POC details at https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md. The project's repository is available at https://github.com/krayin/laravel-crm.
Details
- CWE(s)