CVE-2026-78337CWE-434unrestricted-file-upload

CVE-2026-78337

published August 24, 2026

CVSS
4.8
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

The record
Technical detail
CVSS
4.8 · NONE
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-24T15:16Z
References (2)
https://github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xss · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 24 AUG 11:01Z
    Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
    cvelistv5