Medium severity · published Aug 24, 2026
CVE-2026-78337
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Prospero Flow CRM · Roskus
before 5.15.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78337
github.com
https://github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17
secur0.com
https://secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xss
More from Prospero Flow CRM
9.3
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
9.3
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
8.7
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
8.7
CVE-2026-59233
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
8.7
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts