The vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x. An authenticated user can upload a crafted PHP file, exploiting the CWE‑434 weakness of unrestricted file upload. The application does not validate the file type appropriately, allowing the attacker to place a PHP script in the upload directory. Once uploaded, the script can be accessed through a web browser, resulting in remote code execution. This undermines confidentiality, integrity, and availability of the application and its underlying operating system.

The affected product is Webkul Krayin CRM version 2.2.x. The CRM is offered by Webkul under the Krayin branding. Specific sub‑versions are not listed, but any release identified as 2.2.x is vulnerable.

The CVSS score of 9.9 indicates critical severity. The vulnerability requires authenticated access to the admin interface, but once logged in, the attacker can upload an arbitrary PHP file without restrictions. Because the EPSS score is 4% and the issue is not cataloged in CISA’s KEV, exploit data is limited, yet the high CVSS suggests the potential for widespread damage if the vulnerability is exploited. No public exploit was reported at the time of this assessment, but in the absence of a patch, administrators should treat the vulnerability as actively exploitable.