Low severity · published Sep 25, 2026
CVE-2026-97897
Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · Krayin
2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97897
vdb-entry
https://vuldb.com/vuln/409909
signature
https://vuldb.com/vuln/409909/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-97897
third-party-advisory
https://vuldb.com/submit/915413
related
https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md
issue-tracking
https://github.com/krayin/laravel-crm/pull/2639
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.8
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization