---
id: CVE-2026-78337
title: >-
  Unrestricted Upload of File with Dangerous Type in the company logo upload in
  Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding
  the create company and update company permissions to execute arbitrary
  JavaScript …
summary: >-
  Unrestricted Upload of File with Dangerous Type in the company logo upload in
  Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding
  the create company and update company permissions to execute arbitrary
  JavaScript …
severity: none
cwe:
  - CWE-434
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78337'
references:
  - url: >-
      https://github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17
    label: 4daa8cea-433a-44bd-9456-53b127fc289a
  - url: >-
      https://secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xss
    label: 4daa8cea-433a-44bd-9456-53b127fc289a
tags:
  - nvd
epss: 0.00397
epssPercentile: 0.31963
ingestedAt: '2026-10-12T15:55:08.102Z'
---

## Overview

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.