CVE-2026-97896: Krayin Laravel CRM XSS Vulnerability

CVE-2026-97896 Overview

CVE-2026-97896 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Krayin Laravel-CRM versions up to 2.2.5. The flaw resides in the ConfigurationForm::rules function within packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php, which handles file upload validation for the admin configuration component. Insufficient file-type restrictions allow authenticated users to upload Scalable Vector Graphics (SVG) files that contain embedded JavaScript as logo or favicon images. When another user renders the uploaded asset, the attacker-controlled script executes in their browser session. The maintainers resolved the issue in version 2.2.6 via commit b9836530ec9f5ef0f51653bb0cbbc47ef7184f51.

Critical Impact
Authenticated attackers can store malicious SVG payloads through the admin logo and favicon upload fields, triggering script execution in the context of any user viewing the application.

Affected Products

Krayin Laravel-CRM versions up to and including 2.2.5
Component: Admin Upload Functionality (ConfigurationForm.php)
Fixed in: Krayin Laravel-CRM 2.2.6

Discovery Timeline

2026-09-25 - CVE-2026-97896 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97896

Vulnerability Analysis

The vulnerability stems from permissive MIME type validation in Krayin Laravel-CRM's configuration form handler. The ConfigurationForm::rules method defined upload validation that accepted SVG files as valid image uploads for the admin logo and favicon fields. SVG is an Extensible Markup Language (XML) based image format that permits inline <script> elements and event handlers. When the browser renders an uploaded SVG, any embedded JavaScript executes under the application's origin.

Because the file is persisted server-side and served to every user that loads the branded interface, the payload constitutes a stored XSS. The attack requires authenticated access with permission to modify configuration settings and user interaction to render the asset. Impact is limited to confidentiality and integrity of the victim's browser session rather than the underlying server.

Root Cause

The validation rules in core_config.php whitelisted svg alongside raster formats such as bmp, jpeg, jpg, png, and webp for both the logo_image and favicon_image configuration fields. The upload handler did not sanitize SVG contents or strip executable XML nodes before storage.

Attack Vector

An authenticated administrator or lower-privileged user with configuration access crafts an SVG containing JavaScript, then uploads it through the admin logo or favicon configuration setting. When any user loads a page that references the stored asset, the browser parses the SVG and executes the embedded script in the application's origin.

php

// Patch: packages/Webkul/Admin/src/Config/core_config.php
                 'name' => 'logo_image',
                 'title' => 'admin::app.configuration.index.general.general.admin-logo.logo-image',
                 'type' => 'image',
-                'validation' => 'mimes:bmp,jpeg,jpg,png,webp,svg',
+                'validation' => 'mimes:bmp,jpeg,jpg,png,webp',
             ], [
                 'name' => 'favicon_image',
                 'title' => 'admin::app.configuration.index.general.general.admin-logo.favicon-image',
                 'type' => 'image',
-                'validation' => 'mimes:ico,jpeg,jpg,png,webp,svg',
+                'validation' => 'mimes:ico,jpeg,jpg,png,webp',
             ],

Source: GitHub Commit b9836530. The fix removes svg from the accepted MIME types for both the logo and favicon configuration fields.

Detection Methods for CVE-2026-97896

Indicators of Compromise

SVG files present in the configuration upload directory used for logo or favicon storage
SVG payloads containing <script>, onload=, onerror=, or foreignObject elements
Unexpected modifications to the logo_image or favicon_image configuration values with recent timestamps
Outbound requests from user browsers to attacker-controlled domains following admin branding changes

Detection Strategies

Inspect stored configuration assets for SVG files and parse their XML content for executable elements
Review web server access logs for POST requests to the admin configuration endpoint with multipart/form-data payloads containing SVG MIME types
Audit application audit logs for changes to logo or favicon settings performed by non-standard accounts

Monitoring Recommendations

Alert on uploads of files with .svg extensions or image/svg+xml content type to the Laravel-CRM admin interface
Monitor the application's public image directory for file creations outside of expected administrative workflows
Correlate configuration-change events with subsequent client-side errors or Content Security Policy (CSP) violation reports

How to Mitigate CVE-2026-97896

Immediate Actions Required

Upgrade Krayin Laravel-CRM to version 2.2.6 or later, which removes SVG from the accepted upload MIME types
Audit existing logo_image and favicon_image configuration entries and remove any SVG files uploaded prior to patching
Rotate administrative session tokens if unauthorized configuration changes are discovered

Patch Information

The fix is published in Krayin Laravel-CRM release v2.2.6 via commit b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. The patch is tracked in pull request #2620 and issue #2617. Additional context is available in the GitHub Security Advisory and VulDB entry.

Workarounds

Deploy a web application firewall (WAF) rule to block multipart/form-data uploads containing image/svg+xml to the admin configuration route
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of stored XSS payloads
Restrict configuration-level permissions to a minimal set of trusted administrator accounts

bash

# Upgrade Krayin Laravel-CRM via Composer
composer require krayin/laravel-crm:^2.2.6
php artisan config:clear
php artisan cache:clear