A flaw in the Sanitizer.php file of the TinyMCE Media Upload component in Krayin laravel‑crm versions up to 2.2.5 allows an attacker to inject arbitrary JavaScript when a media file is uploaded. The vulnerability is a classic XSS weakness (CWE‑79) that can be exploited remotely, giving the attacker the ability to execute code in the browser context of users who view the affected content. Such payloads could steal session cookies, deface pages, or perform actions on behalf of legitimate users.

Products impacted are Krayin’s laravel‑crm application. Any installation running version 2.2.5 or earlier is vulnerable. The fix is included in release 2.2.6, which incorporates the patch identified by commit hash 734aa10a. All other versions listed as affected in the CNA data are similarly corrected in 2.2.6.

The CVSS score of 5.1 classifies this issue as medium severity. No EPSS data is presently available, and the vulnerability is not listed in the CISA KEV catalog, but the ability to upload media from a remote source means an attacker who can reach the application endpoint could trigger the flaw. The required conditions are minimal: an authenticated or unauthenticated user must be able to upload a file to the TinyMCE media endpoint. Once triggered, the injected script will run in the victim’s browser whenever the edited content is displayed.