nathanhimself/cve-2026-38526-pocCVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE
CVE-2026-38526 is a critical authenticated remote code execution vulnerability
affecting Webkul Krayin CRM v2.2.x. The vulnerability exists in the TinyMCE
media upload endpoint /admin/tinymce/upload, which fails to validate uploaded
file types. An authenticated attacker can upload a malicious PHP file and execute
arbitrary commands on the server.
The /admin/tinymce/upload endpoint accepts multipart file uploads for the
TinyMCE rich text editor. The server performs no validation on the uploaded
file type or extension, allowing an attacker to upload a PHP webshell. The
uploaded file is stored in a web-accessible directory (/storage/tinymce/),
meaning a subsequent GET request to the file path causes the PHP interpreter
to execute the payload.
Attack flow:
/admin/tinymce/upload with spoofed Content-Type: image/jpegwww-datarequests library (pip install requests)| Flag | Description |
|---|---|
-t | Target URL |
-u | Login email address |
-p | Login password |
-c | OS command to execute on the target |
git clone https://github.com/NathanHimself/CVE-2026-38526-PoC
cd CVE-2026-38526-PoC
chmod +x exploit.py
python3 exploit.py -t <target URL> -u <email> -p <password> -c <command>
This tool is for authorized penetration testing and educational purposes only. Do not use against systems you do not have explicit permission to test. The author assumes no responsibility and shall not be held liable for any misuse, damage, or illegal activity arising from the use of this PoC.