CVE-2026-81931

Received Received - Intake

Unrestricted File Upload in Roskus Prospero Flow CRM

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Secur0

Description

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81931

Affected Vendors & Products

Vendor	Product	Version / Range
roskus	prospero_flow_crm	to 5.16.0 (exc)
roskus	prospero_flow_crm	5.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

CVE-2026-81931 is a stored cross-site scripting (XSS) vulnerability in Prospero Flow CRM versions before 5.16.0. It allows authenticated users with product creation permissions to upload files with a valid image header but a malicious .html extension. The application incorrectly trusts the client-declared file extension instead of validating it against the actual content type. This lets attackers store malicious JavaScript in the web root, which executes when accessed by other users.

Detection Guidance

Check for uploaded files in public/asset/upload/product/ with .html, .htm, or other non-image extensions. Inspect files with valid image headers but mismatched extensions. Review server logs for POST requests to /product/save from non-admin users.

Impact Analysis

An attacker could upload a file disguised as an image but containing HTML/JavaScript. When other users access the file via its URL, the script executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. High-privilege users like administrators are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized modifications, or loss of confidentiality, integrity, and availability of user data.

Mitigation Strategies

Upgrade to Prospero Flow CRM version 5.16.0 or later. Manually delete all files in public/asset/upload/product/. Implement strict file validation to match content with declared extensions. Review and restrict user permissions to prevent unauthorized uploads.

Hi! I’m here to help you understand CVE-2026-81931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70