A remote code execution vulnerability in Krayin Laravel CRM allows authenticated attackers to compromise the application server, presenting a significant security risk.

The application is susceptible to remote code execution via the compose email function. The vulnerability requires the attacker to have at least low-level authenticated access to the system to trigger the flaw.

The ability for an attacker to execute arbitrary code on the host server poses a severe threat to data confidentiality and integrity. Given the CVSS score of 8.1, this is a high-severity issue that could lead to full system compromise, unauthorized data access, or the deployment of further malicious payloads within the internal network.

Immediate Action: Update Krayin Laravel CRM to version 2.1.6 or later to apply the necessary security patches.

Proactive Monitoring: Monitor application logs for unusual activity within the email composition module and track server process spawns originating from the web server user.

Compensating Controls: Implement strict network segmentation and restrict access to the CRM interface to trusted IP addresses to minimize the potential attack surface.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/cybercrewinc/CVE-2026-36340).

This vulnerability represents a significant risk due to the availability of a public proof-of-concept and the high impact of remote code execution. Security teams should prioritize the update to version 2.1.6 immediately to eliminate the vulnerable code path. Organizations unable to patch should restrict access to the CRM to minimize exposure until the update can be applied.