The vulnerability resides in the ConfigurationForm::rules method of the krayin laravel‑crm package. An attacker can submit specially crafted data to the upload endpoint, causing the application to accept unvalidated configuration rules that include arbitrary HTML or JavaScript. When these rules are later rendered by the web interface the malicious payload is executed in the victim’s browser, enabling cross‑site scripting. The weakness is classified as CWE‑79 and, due to the potential for server‑side code injection, also involves CWE‑94. This flaw allows remote actors to compromise user sessions, deface the UI, or steal credentials, while requiring only the ability to access the upload functionality endpoint.

All installations of krayin laravel‑crm version 2.2.5 or earlier are vulnerable. The fix was introduced in release 2.2.6 and is available via commit b9836530ec9f5ef0f51653bb0cbbc47ef7184f51 on GitHub. The vulnerability is exposed through the upload functionality within the administrative configuration form.

The CVSS score of 5.1 places the issue in the medium severity range. The EPSS score is not available, but the vulnerability is publicly exposed on GitHub and community advisories, indicating that exploitation tools are accessible. The flaw can be triggered remotely by sending malformed form data to the upload endpoint without authentication requirements other than standard access to the admin panel. Since it is not listed in the CISA KEV catalog, no immediate awareness campaign is underway, but the combination of medium impact and available exploit code creates a clear risk for affected deployments.