Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-78337 ·
Medium · August 24, 2026

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

S0
Secur0 CNA
CVE-2026-78337

Description

Unrestricted Upload of File with Dangerous Type (CWE-434) and Improper Neutralization of Input During Web Page Generation (CWE-79) in CompanySaveController::save() (app/Http/Controllers/Company/CompanySaveController.php), exposed at POST /company/save, in Prospero Flow CRM before 5.15.13, which allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin against any visitor who opens the file, including unauthenticated visitors, by uploading an SVG document carrying an embedded <script> element as the company logo, because the controller applies no type, extension or size validation to the logo field and builds the destination filename from the content-derived extension before calling storeAs() on the public disk, which the project serves statically under /storage/company/{slug}/{file} outside Laravel routing and therefore without authentication middleware, unlike ProductRequest::rules(), which constrains the equivalent image upload with the image rule and the mimes:jpeg,png,jpg,gif allow-list. This results in arbitrary JavaScript execution in the application context when the stored file is navigated to directly.

Vulnerability type (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected versions

Prospero Flow CRM before 5.15.13. The company logo upload was introduced in commit dbd8f149 (2022-08-07), which predates the version constant in the project, so every published version is affected. All five existing tags (v1.0.0, v2.0.1, v4.6.0, v5.5.3 and v5.14.0) shipped vulnerable. The fix is not tagged and v5.14.0 remains the newest tag in the repository, so no tagged release carries it. Default status: unaffected.

Score (CVSS 4.0)

Medium (4.8)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 5.15.13 or later. No git tag carries the fix, so deployment must be made from the repository main branch: installing v5.14.0, the newest tag, leaves the system affected. The fix validates subsequent uploads but does not remove files already written, so review storage/app/public/company/ and delete any existing SVG documents.

Patch

Commit aaa4fc76

Credits

  • Adrián García López - finder
  • Darío Rivas Quero - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-78337