CVE-2026-81931 in Prospero Flow CRM
Summary
by MITRE • 08/27/2026
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Roskus Prospero Flow CRM versions prior to 5.16.0 represents a critical security flaw classified as an Unrestricted Upload of File with Dangerous Type. This issue specifically affects the product photo upload functionality, allowing authenticated users who possess the create product permission, typically associated with the routine Seller role, to execute arbitrary JavaScript code within the context of the application's origin. The core technical failure lies in the validation logic implemented by the ProductSaveController::save() method and its associated file handling mechanisms. Rather than enforcing strict allow-listing based on both filename extension and MIME type consistency or utilizing a secure randomization strategy for stored filenames, the system relies primarily on checking magic bytes to determine if a file is an image. While it attempts to mitigate risk by rejecting files with specific PHP extensions, this approach is fundamentally flawed because it does not prevent other executable script formats from being uploaded and executed.
The operational mechanism of the exploit involves crafting a malicious file that begins with valid image header data, such as those found in JPEG or PNG files, thereby passing the magic byte validation check. The attacker then appends JavaScript code to this binary data and saves the file with an HTML extension rather than a PHP one. Because the system names the stored file using the client-supplied extension without further sanitization of the content's actual nature beyond the initial header check, the resulting file is saved as an HTML document within the public web root directory at public/asset/upload/product/. When this file is accessed via HTTP, the server serves it with a text/html content type. This configuration allows the embedded JavaScript to execute in the browser context of any user who views the product photo, effectively turning the image upload feature into a vector for first-party stored cross-site scripting attacks.
The impact of this vulnerability extends beyond simple script execution. Since the malicious code runs in the application origin, it has access to all cookies, local storage, and session tokens associated with that domain. An attacker can leverage this capability to hijack user sessions, steal sensitive data such as customer information or internal business records, perform actions on behalf of victims without their consent, or redirect users to phishing sites. This undermines the integrity and confidentiality of the CRM system, potentially leading to significant financial loss and reputational damage for organizations relying on Roskus Prospero Flow for their sales operations. The ability to store persistent scripts means that every subsequent visit by any authenticated user to a product page containing the malicious image can trigger the attack, creating a widespread and enduring threat vector within the application environment.
To mitigate this vulnerability, immediate action is required to upgrade to version 5.16.0 or later where these issues have been addressed. In the interim, administrators should implement strict file validation practices that include verifying both the MIME type reported by the server and the actual content of the uploaded files using robust libraries rather than simple magic byte checks. It is crucial to rename all uploaded files with random, unpredictable strings to prevent attackers from controlling the filename extension used for storage. Furthermore, stored files should be placed outside the public web root whenever possible, or if they must reside in a publicly accessible directory, they should be served by an application layer that explicitly sets content types to binary/octet-stream rather than allowing default server behavior which might interpret HTML extensions as executable scripts. Implementing Content Security Policy headers can also help mitigate the impact of any successful script execution by restricting where scripts can load from and preventing inline script execution.
From a classification perspective, this vulnerability aligns with CWE-434 Unrestricted Upload of File with Dangerous Type and CWE-79 Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting (XSS). The attack vector corresponds to the ATT&CK technique T1505.003 Server-side web framework scripting, where attackers upload malicious scripts to a server for later execution. Additionally, because it involves stored persistence that affects multiple users over time, it relates to T1059.007 JavaScript and T1189 Drive-by Compromise through the browser context of victims visiting affected pages. Addressing these issues requires a defense-in-depth approach combining secure coding standards for file handling, rigorous input validation, and appropriate server configuration to ensure that uploaded content is treated strictly as data rather than executable code.