CVE-2026-78337: Roskus Prospero Flow CRM XSS Vulnerability

CVE-2026-78337 Overview

CVE-2026-78337 is a stored cross-site scripting (XSS) vulnerability in Roskus Prospero Flow CRM versions before 5.15.13. The application accepts Scalable Vector Graphics (SVG) files as company logos without stripping embedded <script> elements. An authenticated user holding the create company or update company permissions can upload a crafted SVG that executes arbitrary JavaScript in the application origin when rendered. The flaw is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the application origin, enabling session theft, forced actions against other users, and lateral movement within the CRM tenant.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.15.13
Deployments exposing the company logo upload endpoint to any authenticated user with company management permissions
Multi-tenant instances where SVG assets are served from the application origin

Discovery Timeline

2026-08-24 - CVE-2026-78337 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78337

Vulnerability Analysis

The vulnerability resides in the company logo upload path handled by CompanySaveController. The controller accepted uploaded files without validating their content type or sanitizing SVG payloads. SVG is an XML-based format that permits inline <script> elements and event handler attributes. When the browser fetches the uploaded logo from the CRM origin, it parses the SVG and executes the embedded JavaScript with the privileges of the viewing user.

Because the malicious asset is served from the application origin, the attacker's script has full access to session cookies, CSRF tokens, and Document Object Model (DOM) state of the CRM. Any user who loads a page rendering the tampered company logo becomes a victim, including administrators.

Root Cause

The root cause is missing file content validation in the upload handler. The prior save method used a generic Request object and only checked permission strings, without applying MIME validation or SVG-specific sanitization. There was no dedicated Form Request or validation rule to reject dangerous SVG constructs, and the destination company identifier was not bound to the authenticated user's company_id.

Attack Vector

An authenticated user with create company or update company permission submits a POST request to the company save endpoint with a crafted SVG file as the logo. The SVG contains an embedded script that fires when the image is rendered inline. The attack requires user interaction: another user must view a page displaying the malicious logo.

php

// Vulnerable controller (pre-patch) — accepted Request without SVG validation
class CompanySaveController extends MainController
{
    private CompanyRepository $companyRepository;

    public function __construct(Request $request, CompanyRepository $companyRepository)
    {
        parent::__construct($request);
        $this->companyRepository = $companyRepository;
    }

    public function save(Request $request)
    {
        if (empty($request->id)) {
            if (Auth::user()->cannot('create company')) {
                return redirect(route('company.index'))->with('error', __('Unauthorized'));
            }
        }
        // Logo file processed without SVG sanitization
    }
}

Source: Roskus prospero-flow-crm commit aaa4fc7

Detection Methods for CVE-2026-78337

Indicators of Compromise

Uploaded logo files with .svg extension containing <script>, onload=, or onerror= attributes
HTTP POST requests to the company save endpoint carrying Content-Type: image/svg+xml payloads
Unexpected outbound requests from user browsers to attacker-controlled domains after loading CRM pages
Session tokens or authenticated API calls originating from unusual client fingerprints shortly after a logo upload

Detection Strategies

Parse stored logo assets for XML script tags and event handler attributes before serving
Correlate create company or update company audit events with subsequent access to /storage/ or logo asset paths
Monitor Content Security Policy (CSP) violation reports for inline script executions from image endpoints

Monitoring Recommendations

Alert on any SVG upload where the file body contains <script (case-insensitive) or javascript: URIs
Track anomalous session activity following logo changes, particularly administrator sessions viewing company profiles
Review web server access logs for repeated fetches of specific logo files across multiple user sessions

How to Mitigate CVE-2026-78337

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to version 5.15.13 or later
Audit existing company logo assets for embedded scripts and remove any suspicious SVG files
Rotate session cookies and API tokens for accounts that may have viewed a tampered logo
Restrict create company and update company permissions to trusted administrative roles

Patch Information

The vendor patch introduces a dedicated CompanySaveRequest Form Request and a ValidateSafeSvg rule that rejects SVG uploads containing scripts or event handlers. The controller was refactored to consume the validated request, and authorization now confirms that the target id matches the authenticated user's company_id. Review the commit aaa4fc7 and the Secur0 advisory for full remediation details.

php

// Patched Form Request enforcing safe SVG uploads
class CompanySaveRequest extends FormRequest
{
    public function authorize(): bool
    {
        if (empty($this->id)) {
            return Auth::user()->can('create company');
        }
        return Auth::user()->can('update company')
            && (int) $this->id === (int) Auth::user()->company_id;
    }

    public function rules(): array
    {
        return [
            'id' => 'nullable|integer',
            'name' => 'required|string|max:255',
            'logo' => ['nullable', 'file', new ValidateSafeSvg()],
        ];
    }
}