CVE-2026-112288
CVE-2026-112288 · Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
CVSS 2.1 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
laravel-crm
- Versions
- ≥ 2.2.5, < 2.2.7: Affected (semver)
Update to 2.2.7
Original sources
- https://github.com/krayin/laravel-crm/pull/2683
- https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.7
- https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding
- https://nvd.nist.gov/vuln/detail/CVE-2026-112288