CVE-2026-78337: Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.13 - Operational
Review and remove existing SVG files under storage/app/public/company/ to eliminate previously stored SVG-based XSS payloads.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have both the create company and update company permissions. The issue is therefore exposed to users who can manage company records and upload a company logo.
What does exploitation require?
The attacker needs to upload an SVG document containing an embedded script element as a company logo. When the SVG is executed in the application origin, the embedded JavaScript can run in that origin.
Which versions are affected?
Roskus Prospero Flow CRM versions before 5.15.13 are affected.