CVE-2026-78337 in Prospero Flow CRM
Summary
by MITRE • 08/24/2026
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified as Unrestricted Upload of File with Dangerous Type within Roskus Prospero Flow CRM prior to version 5.15.13 represents a critical security flaw rooted in inadequate input validation and file type verification mechanisms during the company logo upload process. This issue specifically affects authenticated users who possess the create company and update company permissions, allowing them to bypass standard security controls by uploading maliciously crafted files that are subsequently executed within the context of the application's origin. The core technical failure lies in the server-side processing logic which fails to strictly enforce a whitelist of allowed file extensions or perform deep content inspection on uploaded assets. Instead of validating the MIME type against actual file signatures, the system likely relies solely on client-supplied metadata or simple extension checks, creating an opening for attackers to disguise executable scripts as benign image files.
The operational impact of this vulnerability is significant due to its potential to facilitate Stored Cross-Site Scripting attacks. By uploading an SVG document that contains embedded JavaScript elements, an authenticated user can inject malicious code directly into the application's data store or rendering pipeline. When other users view a company profile containing the compromised logo, the browser interprets and executes the script within the context of the Roskus Prospero Flow CRM domain. This allows the attacker to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions on behalf of victims, or defacing the application interface. Because the attack vector is tied to a legitimate feature like logo uploads, it can remain undetected for extended periods while affecting multiple users who access affected company records.
From an industry standards perspective, this vulnerability aligns with CWE-434 Unrestricted Upload of File with Dangerous Type and CWE-79 Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The attack technique is further categorized under MITRE ATT&CK T1059 Command and Control scripting or potentially T1189 Drive-by Client Side Execution depending on the specific exploitation method, though in this context it functions more akin to a stored payload delivery mechanism similar to T1071 Application Layer Protocol. The lack of proper sanitization allows arbitrary code execution within the trusted domain, violating fundamental principles of secure web application development regarding input validation and output encoding.
To mitigate this vulnerability, immediate patching to version 5.15.13 or later is required as it addresses the underlying file handling logic. In environments where upgrading is not immediately feasible, administrators should implement strict server-side validation that verifies both the file extension and the actual content signature using a robust library capable of detecting SVG structures. Additionally, implementing Content Security Policy headers can help mitigate the impact by restricting script execution sources, although this does not resolve the root cause. Enforcing least privilege principles to limit who holds create company permissions reduces the attack surface, while regular security audits focusing on file upload functionalities are essential for maintaining long-term resilience against similar threats.