Executive brief
Prospero Flow CRM is a customer relationship management system used by businesses to manage company data and interactions. The application failed to properly validate file uploads in the company logo field, allowing authenticated users with company creation/update permissions to upload malicious SVG files containing embedded JavaScript code. When visitors view or access the stored logo file, the embedded script executes in the application's security context, potentially compromising account data or session information for any user who accesses it.
Technical details
This vulnerability combines CWE-434 (unrestricted file upload) and CWE-79 (stored cross-site scripting). The CompanySaveController::save() endpoint at POST /company/save failed to validate the file type, extension, or size for the logo upload field. An authenticated user holding create company and update company permissions could upload an SVG document containing embedded <script> tags or event handlers. The uploaded file is stored in the public disk and served statically at /storage/company/{slug}/{file} outside Laravel routing, bypassing authentication middleware. When any user (authenticated or unauthenticated) navigates to or views the malicious SVG file, the embedded JavaScript executes in the application origin, allowing session hijacking or data theft. The vulnerability affects all versions of Prospero Flow CRM before 5.15.13. A patch was committed (aaa4fc76) implementing file validation rules restricting uploads to safe image formats (jpeg, jpg, png, webp, svg), enforcing a 2MB file size limit, and adding a ValidateSafeSvg rule to block dangerous patterns including script tags, event handlers, javascript: URIs, and embedded iframes/objects.
Affected products
- Roskus Prospero Flow CRM before 5.15.13
Timeline
- 2026-08-24: disclosed
- 2026-07-30: patched: Fix committed to main branch (commit aaa4fc76); not yet released in a tagged version