The vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x. An authenticated user can upload a crafted PHP file. The description indicates that the application accepts files for upload without restricting or validating the file type. From this, one can infer that the application does not perform proper file type validation, which aligns with the listed CWE‑434 weakness of unsafe file upload. When the attacker uploads a PHP script, it can be accessed through a web browser, enabling remote code execution and thereby compromising the confidentiality, integrity, and availability of the application and its underlying system.

The affected product is Webkul Krayin CRM version 2.2.x. The CRM is offered by Webkul under the Krayin branding. Specific sub-versions are not listed, but any release identified as 2.2.x is vulnerable.

The CVSS score of 9.9 indicates critical severity. The vulnerability requires authenticated access to the admin interface; once logged in, the attacker can upload an arbitrary PHP file without restrictions. The EPSS score of 4% indicates a moderate probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, its high CVSS and the presence of a public PoC suggest that exploitation is possible. Administrators should treat the vulnerability as actively exploitable in the absence of a patch.