# CVE-2026-81931: Roskus Prospero Flow CRM stored XSS in product photo upload

Source: https://junglewise.ai/threats/cve-2026-81931-roskus-prospero-flow-crm-stored-xss-in-product-photo-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81931 · Severity: info · CVSS 4.8 · Published 2026-08-27

Prospero Flow CRM is a customer relationship management platform used to manage business operations and client interactions. A vulnerability in the product photo upload feature allows authenticated users with standard seller permissions to upload files that execute malicious JavaScript in the browsers of other users who view the uploaded photo, potentially compromising account integrity and sensitive business data for anyone who clicks the photo link, including administrative users.

Technologies: [Roskus Prospero Flow CRM](https://junglewise.ai/threats/technologies/prospero-flow-crm). Vendors: [Roskus](https://junglewise.ai/threats/vendors/roskus).

## Quick answers

**Is CVE-2026-81931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81931 being exploited in the wild.

**How severe is CVE-2026-81931?** Informational severity, with a CVSS score of 4.8, published 27 August 2026.

**Which products and versions are affected?** Roskus Prospero Flow CRM before 5.16.0.

**Is there a fix for CVE-2026-81931?** A patch was published on 2026-08-27: Fix available in main branch; version 5.16.0 not yet released with tag Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81931 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81931?** Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw resulting from unrestricted file upload (CWE-434) in the ProductSaveController::save() method. The photo validation rule classifies files by content (magic bytes) and maintains a denylist of dangerous PHP extensions (php, php3-php8, phtml, phar), but fails to prevent HTML extensions. The vulnerable code uses getClientOriginalExtension() to derive the stored filename from the client-supplied extension rather than the validated content type, and stores the file in the public web root at public/asset/upload/product/. An attacker with create product permission can upload a file starting with valid image magic bytes but named with an .html extension; it passes validation, is stored as <uuid>.html, and served by nginx with Content-Type: text/html without requiring authentication, enabling first-party JavaScript execution. The fix in version 5.16.0 replaces getClientOriginalExtension() with extension() and adds an ExtensionMatchesContent validation rule; however, the fix is not yet released in a tagged version and users must deploy from the main branch.

## Affected products

- Roskus Prospero Flow CRM before 5.16.0

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: Fix available in main branch; version 5.16.0 not yet released with tag

## References

- [https://github.com/Roskus/prospero-flow-crm/commit/71b20e1a37f4381d1b8b0a6933a942324e1cc19f](https://github.com/Roskus/prospero-flow-crm/commit/71b20e1a37f4381d1b8b0a6933a942324e1cc19f)
- [https://secur0.com/en/cna/cve-list/cve-2026-81931-unrestricted-upload-product-photo-extension-confusion-xss](https://secur0.com/en/cna/cve-list/cve-2026-81931-unrestricted-upload-product-photo-extension-confusion-xss)

## Related threats

- [Roskus Prospero Flow CRM authorization bypass in user API](https://junglewise.ai/threats/cve-2026-114519-missing-authorization-cwe-862-in-the-user-api-of-roskus-prospero)
- [Roskus Prospero Flow CRM cross-site request forgery in order confirmation](https://junglewise.ai/threats/cve-2026-82911-roskus-prospero-flow-crm-cross-site-request-forgery-in-order)
- [Roskus Prospero Flow CRM authorization bypass in supplier API](https://junglewise.ai/threats/cve-2026-78365-roskus-prospero-flow-crm-authorization-bypass-in-supplier-api)
- [Roskus Prospero Flow CRM stored XSS in company logo upload](https://junglewise.ai/threats/cve-2026-78337-roskus-prospero-flow-crm-stored-xss-in-company-logo-upload)
- [Roskus Prospero Flow CRM authorization bypass in transaction save](https://junglewise.ai/threats/cve-2026-77780-roskus-prospero-flow-crm-authorization-bypass-in-transaction-save)