Medium severity · published Sep 27, 2026
CVE-2026-100884
Krayin laravel-crm attachment-download Endpoint acl.php resource injection
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · Krayin
2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100884
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100884
vdb-entry
https://vuldb.com/vuln/410814
signature
https://vuldb.com/vuln/410814/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-100884
third-party-advisory
https://vuldb.com/submit/916218
issue-tracking
https://github.com/krayin/laravel-crm/issues/2624
issue-tracking
https://github.com/krayin/laravel-crm/pull/2627
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.8
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization