Executive brief
Prospero Flow CRM is a customer relationship management platform used to manage business operations and client interactions. A vulnerability in the product photo upload feature allows authenticated users with standard seller permissions to upload files that execute malicious JavaScript in the browsers of other users who view the uploaded photo, potentially compromising account integrity and sensitive business data for anyone who clicks the photo link, including administrative users.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw resulting from unrestricted file upload (CWE-434) in the ProductSaveController::save() method. The photo validation rule classifies files by content (magic bytes) and maintains a denylist of dangerous PHP extensions (php, php3-php8, phtml, phar), but fails to prevent HTML extensions. The vulnerable code uses getClientOriginalExtension() to derive the stored filename from the client-supplied extension rather than the validated content type, and stores the file in the public web root at public/asset/upload/product/. An attacker with create product permission can upload a file starting with valid image magic bytes but named with an .html extension; it passes validation, is stored as <uuid>.html, and served by nginx with Content-Type: text/html without requiring authentication, enabling first-party JavaScript execution. The fix in version 5.16.0 replaces getClientOriginalExtension() with extension() and adds an ExtensionMatchesContent validation rule; however, the fix is not yet released in a tagged version and users must deploy from the main branch.
Affected products
- Roskus Prospero Flow CRM before 5.16.0
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fix available in main branch; version 5.16.0 not yet released with tag