CVE-2026-78337
Received Received - Intake

Unrestricted File Upload in Roskus Prospero Flow CRM

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Secur0

Description
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78337
EUVD
EUVD-2026-64825

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roskus prospero_flow_crm to 5.15.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78337 is a stored cross-site scripting (XSS) vulnerability in Roskus Prospero Flow CRM versions before 5.15.13. It allows authenticated users with create or update company permissions to upload malicious SVG files as company logos. The application fails to validate file types properly, enabling embedded scripts to execute when the SVG is accessed, potentially compromising user sessions or data.

Detection Guidance

Check for unauthorized SVG files in the company logo storage directory of Prospero Flow CRM. Look for files with .svg extensions or content-derived extensions that may contain embedded scripts. Review server logs for unusual access patterns to SVG files.

Impact Analysis

An attacker could upload a malicious SVG file containing JavaScript. When users access the logo, the script runs in the application's context, potentially stealing session cookies, redirecting users, or performing actions on their behalf. This could lead to unauthorized data access or account takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face fines or penalties for failing to protect sensitive user information due to inadequate security controls.

Mitigation Strategies

Upgrade Prospero Flow CRM to version 5.15.13 or later. Manually review and delete any existing SVG files in the storage directory. Implement strict file upload validation to block SVG files containing scripts or harmful elements. Restrict file types to JPEG, JPG, PNG, WebP, and safe SVG formats with a 2MB size limit.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart