Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-100882

CVE-2026-100882: Krayin Laravel-CRM XSS Vulnerability

CVE-2026-100882 is a cross-site scripting flaw in Krayin Laravel-CRM that allows remote attackers to inject malicious scripts through admin settings. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-100882 Overview

CVE-2026-100882 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Krayin laravel-crm versions up to 2.2.5. The flaw resides in the Admin Settings endpoint, specifically in packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php. An authenticated administrator can manipulate the general.settings.footer.label parameter to inject arbitrary HTML and JavaScript. The payload is then rendered unescaped on pages that include the footer layout. The exploit has been publicly disclosed, and upgrading to version 2.2.6 resolves the issue.

Critical Impact

Authenticated attackers with administrative privileges can store malicious scripts in the application footer, executing JavaScript in the browsers of all subsequent users who load affected pages.

Affected Products

  • Krayin laravel-crm versions up to and including 2.2.5
  • Component: Admin Settings Endpoint
  • File: packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php

Discovery Timeline

  • 2026-09-27 - CVE-2026-100882 published to the National Vulnerability Database
  • 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100882

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Krayin laravel-crm administrative settings interface. The affected Blade template renders the footer label configuration value using Laravel's raw output syntax {!! !!}, which bypasses HTML escaping. When an attacker with administrative access submits a crafted payload for the general.settings.footer.label configuration key, that value is persisted in the application configuration. Every subsequent page load that includes the footer layout then executes the injected script in the victim's browser context.

A second related issue, patched in the same commit, exists in packages/Webkul/Admin/src/Resources/views/mail/index.blade.php, where the Vue directive v-html rendered the truncatedReply(record.reply) value without sanitization. Both sinks allowed persisted markup to execute in authenticated user sessions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Blade template uses the raw output operator {!! ... !!} on configuration data sourced from core()->getConfigData('general.settings.footer.label'), trusting administrator-controlled input without applying HTML sanitization. Similarly, the mail view uses v-html instead of a safe-HTML directive.

Attack Vector

Exploitation requires network access to the application and high privileges, specifically an authenticated administrator account. The attacker navigates to the admin settings interface and submits a script payload as the footer label. User interaction is required for triggering, as victims must subsequently load a page that renders the footer. Impact is limited because the required privilege level is already elevated, but the injected script can still perform actions against lower-privileged users who view affected pages.

php
// Patched code - packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php
<!-- Powered By -->
<div class="fixed bottom-0 left-0 right-0 z-1">
    <div class="border-t bg-white py-5 text-center text-sm font-normal dark:border-gray-800 dark:bg-gray-900 dark:text-white max-md:py-3">
-        <p>{!! core()->getConfigData('general.settings.footer.label') !!}</p>
+        <p>{!! core()->sanitizeHtml(core()->getConfigData('general.settings.footer.label')) !!}</p>
    </div>
</div>

Source: GitHub Commit #6dbcf75

The fix wraps the configuration value in core()->sanitizeHtml() before rendering, neutralizing injected markup. A parallel change in the mail view replaces v-html with v-safe-html for the truncatedReply(record.reply) binding.

Detection Methods for CVE-2026-100882

Indicators of Compromise

  • Unexpected HTML tags or <script> elements stored in the general.settings.footer.label configuration value within the application database.
  • Outbound requests from administrator or user browser sessions to attacker-controlled domains originating from pages that render the Krayin admin footer.
  • Audit log entries showing modification of general settings by accounts that do not normally administer branding or footer configuration.

Detection Strategies

  • Query the Krayin configuration store for the general.settings.footer.label key and inspect its value for HTML or JavaScript content.
  • Review web server access logs for POST requests to the admin settings update endpoint, correlating with the submitting user account.
  • Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from the footer region of the application.

Monitoring Recommendations

  • Alert on changes to Krayin administrative configuration keys, treating settings mutations as privileged operations.
  • Monitor administrator session activity for anomalous page interactions following footer configuration updates.
  • Correlate Blade template renders of footer content with downstream browser telemetry indicating script execution.

How to Mitigate CVE-2026-100882

Immediate Actions Required

  • Upgrade Krayin laravel-crm to version 2.2.6 or later, which includes patch commit 6dbcf75b30dbd169ee81b7e9e00368099124efeb.
  • Audit the stored value of general.settings.footer.label and remove any HTML or JavaScript payloads prior to upgrading.
  • Review administrator account activity for unauthorized settings changes and rotate credentials for any suspicious accounts.

Patch Information

The official patch is available in the GitHub Release v2.2.6. The code change is documented in GitHub Commit #6dbcf75, tracked under GitHub Issue #2622 and merged via GitHub Pull Request #2625. The fix applies core()->sanitizeHtml() to the footer label and replaces unsafe v-html bindings with v-safe-html.

Workarounds

  • Restrict administrative access to the Krayin settings interface using network-layer controls or role-based access limitations until the upgrade is applied.
  • Manually clear or overwrite the general.settings.footer.label configuration value with a safe plain-text string.
  • Deploy a strict Content Security Policy that disallows inline scripts to limit the impact of injected payloads.
bash
# Upgrade Krayin laravel-crm to the patched release
cd /path/to/laravel-crm
git fetch --tags
git checkout v2.2.6
composer install --no-dev --optimize-autoloader
php artisan config:clear
php artisan view:clear
php artisan cache:clear

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne