Arbitrary Code Injection

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the compose email...

CVE-2026-36340

CVE-2026-36340 affects Krayin CRM v2.1.5; fixed in v2.1.6. The issue arises in Email → Compose when attaching files, allowing an authenticated user to upload PHP payloads to a publicly accessible directory, enabling remote code execution. Upgrade to v2.1.6 or apply vendor mitigations; PoC indicat...