This vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM version 2.2.x. An attacker with authenticated access can upload arbitrary files, including malicious PHP scripts, which can then be executed on the server. This results in remote code execution with high impact on the affected system. The vulnerability has a CVSS v3.1 base score of 9.9, reflecting its critical nature and ease of exploitation with low privileges and no user interaction required.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected server, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with a scope change, making it critical for affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /admin/tinymce/upload endpoint to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary authenticated access to reduce risk.