Is CVE-2026-78337 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78337 being exploited in the wild.

How severe is CVE-2026-78337?

Informational severity, with a CVSS score of 4.8, published 24 August 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM before 5.15.13.

Is there a fix for CVE-2026-78337?

A patch was published on 2026-07-30: Fix committed to main branch (commit aaa4fc76); not yet released in a tagged version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78337 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78337?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78337: Roskus Prospero Flow CRM stored XSS in company logo upload

CVE-2026-78337 · Severity: info · CVSS 4.8 · Published 2026-08-24

Prospero Flow CRM is a customer relationship management system used by businesses to manage company data and interactions. The application failed to properly validate file uploads in the company logo field, allowing authenticated users with company creation/update permissions to upload malicious SVG files containing embedded JavaScript code. When visitors view or access the stored logo file, the embedded script executes in the application's security context, potentially compromising account data or session information for any user who accesses it.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-78337 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78337 being exploited in the wild.
How severe is CVE-2026-78337?: Informational severity, with a CVSS score of 4.8, published 24 August 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM before 5.15.13.
Is there a fix for CVE-2026-78337?: A patch was published on 2026-07-30: Fix committed to main branch (commit aaa4fc76); not yet released in a tagged version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78337 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78337?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability combines CWE-434 (unrestricted file upload) and CWE-79 (stored cross-site scripting). The CompanySaveController::save() endpoint at POST /company/save failed to validate the file type, extension, or size for the logo upload field. An authenticated user holding create company and update company permissions could upload an SVG document containing embedded <script> tags or event handlers. The uploaded file is stored in the public disk and served statically at /storage/company/{slug}/{file} outside Laravel routing, bypassing authentication middleware. When any user (authenticated or unauthenticated) navigates to or views the malicious SVG file, the embedded JavaScript executes in the application origin, allowing session hijacking or data theft. The vulnerability affects all versions of Prospero Flow CRM before 5.15.13. A patch was committed (aaa4fc76) implementing file validation rules restricting uploads to safe image formats (jpeg, jpg, png, webp, svg), enforcing a 2MB file size limit, and adding a ValidateSafeSvg rule to block dangerous patterns including script tags, event handlers, javascript: URIs, and embedded iframes/objects.

Affected products

Roskus Prospero Flow CRM before 5.15.13

Timeline

2026-08-24: disclosed
2026-07-30: patched: Fix committed to main branch (commit aaa4fc76); not yet released in a tagged version

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.