CVE-2026-97897: Krayin Laravel CRM TinyMCE XSS Vulnerability

CVE-2026-97897 Overview

CVE-2026-97897 is a stored cross-site scripting (XSS) vulnerability in Krayin laravel-crm versions up to and including 2.2.5. The flaw resides in the Sanitizer.php file within the TinyMCE Media Upload component. An authenticated remote attacker can inject malicious script content that executes in the browser context of other users who view the affected content. The issue is tracked under [CWE-79] and has been patched in version 2.2.6 via commit 734aa10ae6c2ffa4c96c8869a89aa66940e4d345.

Critical Impact
Attackers with low-privilege accounts can inject persistent JavaScript payloads that execute against CRM users, enabling session theft, credential harvesting, or unauthorized actions in the CRM interface.

Affected Products

Krayin laravel-crm versions up to and including 2.2.5
Component: TinyMCE Media Upload (Sanitizer.php)
Fixed in: Krayin laravel-crm 2.2.6

Discovery Timeline

2026-09-25 - CVE-2026-97897 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97897

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in the TinyMCE Media Upload functionality of Krayin laravel-crm. The Sanitizer.php component fails to properly neutralize script-bearing input before it is persisted and later rendered in the CRM UI. Because the payload is stored server-side, it executes every time an authenticated user loads the affected view.

Exploitation requires only low privileges and some user interaction, which maps to typical CRM workflows where staff frequently review notes, media, or rich-text content from colleagues. Successful exploitation can lead to session hijacking, forced actions within the CRM, or exfiltration of data visible to the victim.

The EPSS probability currently sits in the low range, indicating limited observed exploitation activity, but stored XSS in internal business tools is routinely leveraged in targeted intrusions.

Root Cause

The root cause is insufficient input sanitization in Sanitizer.php when handling content submitted through the TinyMCE Media Upload workflow. The component allowed HTML or script constructs that TinyMCE accepts as rich content to persist without being neutralized, resulting in script execution upon rendering.

Attack Vector

The attack is performed remotely over the network against an authenticated session. An attacker with a low-privilege CRM account submits crafted rich-text or media-upload content containing script payloads. When another user, typically an administrator or sales operator, opens the record containing the stored payload, the script executes in their authenticated browser context.

php

// Patch excerpt from config/concord.php reordering module providers
// Source: https://github.com/krayin/laravel-crm/commit/734aa10ae6c2ffa4c96c8869a89aa66940e4d345
return [
    'modules' => [
+       DataTransferModuleServiceProvider::class,
        AdminModuleServiceProvider::class,
        AttributeModuleServiceProvider::class,
        AutomationModuleServiceProvider::class,
        ContactModuleServiceProvider::class,
        CoreModuleServiceProvider::class,
-       DataTransferModuleServiceProvider::class,
        DataGridModuleServiceProvider::class,
        EmailTemplateModuleServiceProvider::class,
        EmailModuleServiceProvider::class,

Source: GitHub Commit 734aa10

Detection Methods for CVE-2026-97897

Indicators of Compromise

Rich-text or media-upload records in the CRM containing <script>, onerror=, onload=, or javascript: constructs.
Outbound HTTP requests from CRM user browsers to unknown domains immediately after loading a CRM record view.
Unexpected session-cookie or auth-token exfiltration patterns observed in web proxy logs during CRM usage.

Detection Strategies

Review stored CRM content submitted by low-privilege users for HTML event handlers, inline scripts, or encoded script payloads.
Instrument the web application with a strict Content Security Policy (CSP) in report-only mode to surface inline-script violations originating from CRM views.
Correlate authenticated CRM sessions with anomalous API calls initiated from the same browser session following record access.

Monitoring Recommendations

Monitor web server access logs for POST requests to TinyMCE media-upload endpoints containing suspicious payload patterns.
Alert on CRM users whose sessions issue API calls inconsistent with their role shortly after viewing records authored by another account.
Track version information of deployed krayin/laravel-crm instances to identify unpatched installations.

How to Mitigate CVE-2026-97897

Immediate Actions Required

Upgrade Krayin laravel-crm to version 2.2.6 or later, which includes commit 734aa10ae6c2ffa4c96c8869a89aa66940e4d345.
Audit existing CRM records authored since the last known-good state for stored script payloads and remove any malicious content.
Enforce a restrictive Content Security Policy that disallows inline scripts and limits permitted script sources.

Patch Information

The vendor fix is published in the Krayin laravel-crm v2.2.6 release. The remediation is tracked in Pull Request #2639 and applied in commit 734aa10. Technical analysis is available in the GitHub Security Advisory and the VulDB report.

Workarounds

Restrict access to the TinyMCE Media Upload feature to trusted administrator accounts until the patch is deployed.
Deploy a web application firewall (WAF) rule to block requests containing script tags or inline event handlers targeting CRM upload endpoints.
Apply strict output encoding at render time for any field originating from Sanitizer.php-processed content.

bash

# Upgrade Krayin laravel-crm to the patched release
composer require krayin/laravel-crm:^2.2.6
php artisan migrate
php artisan view:clear
php artisan config:clear