CVE-2026-36340 Details

A remote code execution vulnerability has been identified in Krayin CRM version 2.1.5. This issue allows authenticated users to execute arbitrary code by uploading malicious PHP files through the email composition feature. The uploaded files are stored in a publicly accessible directory without proper validation, allowing the executed payloads to be accessed via their URLs.

Users are advised to update to Krayin CRM version 2.1.6, which addresses this vulnerability. Additionally, implement measures such as restricting allowed file extensions, validating MIME types, storing uploads outside publicly accessible directories, blocking execution of uploaded files via web server rules, and monitoring upload directories for suspicious files.