The vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x. An authenticated user can upload a crafted PHP file. The web application accepts the file without validating the file type, allowing the attacker to place a PHP script in the upload directory. Once the file is uploaded, the attacker can access it via a web browser, resulting in remote code execution. This undermines the confidentiality, integrity, and availability of the application and its underlying operating system.

The affected product is Webkul Krayin CRM version 2.2.x. The CRM is offered by Webkul under the Krayin branding. Specific sub‑versions are not listed, but any release identified as 2.2.x is vulnerable.

The CVSS score of 9.9 indicates critical severity. The vulnerability requires authenticated access to the admin interface, but once logged in, the attacker can upload an arbitrary PHP file without restrictions. Because the EPSS score is not available and the issue is not cataloged in CISA’s KEV, exploit data is limited, yet the high CVSS suggests the potential for widespread damage if the vulnerability is exploited. No public exploit was reported at the time of this assessment, but in the absence of a patch, administrators should treat the vulnerability as actively exploitable.