Medium severityNVD Advisory· Published Aug 24, 2026· Updated Aug 24, 2026

CVE-2026-78337

Description

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Roskus/Prospero Flow CRMllm-fuzzy
Range: <5.15.13

Patches

Vulnerability mechanics

References

github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17nvd
secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xssnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000