CVE-2026-97897 in laravel-crm
Summary
by MITRE • 09/25/2026
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
A critical security vulnerability has been identified within Krayin, a Laravel-based CRM solution, specifically affecting versions up to 2.2.5. The flaw resides in the file Sanitizer.php, which is part of the TinyMCE Media Upload component responsible for handling media files uploaded through the rich text editor interface. This issue manifests as an input validation failure where user-supplied data is not adequately sanitized before being processed or stored. Consequently, this allows attackers to inject malicious scripts into web pages viewed by other users, leading to a Cross-Site Scripting (XSS) attack vector that can be exploited remotely without requiring prior authentication in some configurations, although typically such uploads require at least basic access privileges within the CRM system.
The technical nature of this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The root cause lies in the insufficient filtering or encoding of special characters and script tags embedded within uploaded media metadata or associated file properties managed by the TinyMCE integration. When an attacker crafts a malicious payload disguised as part of a legitimate upload request, the application fails to neutralize these inputs effectively. This oversight permits the execution of arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking, credential theft, defacement of the user interface, or redirection to phishing sites. The impact is significant because it compromises the integrity and confidentiality of data within the CRM environment, affecting not only the attacker but also any other users who interact with the compromised content.
From a threat intelligence perspective, this vulnerability can be mapped to MITRE ATT&CK techniques related to Client-side Injection, specifically T1059 which covers Command and Scripting Interpreter execution via browser-based scripts. The remote exploitability of this flaw means that an adversary could potentially leverage it as part of a broader attack chain, such as delivering malware or stealing sensitive customer data stored within the Krayin platform. Given that CRM systems often contain highly sensitive business information including client details, sales pipelines, and communication logs, the successful exploitation of this XSS vulnerability poses a substantial risk to organizational security posture and compliance with data protection regulations.
To mitigate this risk, immediate action is required by upgrading the Krayin installation to version 2.2.6 or later. The developers have addressed this issue through patch identifier 734aa10ae6c2ffa4c96c8869a89aa66940e4d345, which implements stricter input validation and output encoding mechanisms within the Sanitizer.php file. Administrators should ensure that their development or deployment pipelines automatically pull this updated version to close the security gap. Additionally, it is recommended to implement Content Security Policy headers in web server configurations to provide an additional layer of defense against XSS attacks by restricting the sources from which scripts can be loaded and executed. Regular security audits and penetration testing of custom integrations with third-party components like TinyMCE are also advised to detect similar vulnerabilities before they can be exploited in production environments.