CVE-2026-81931: CWE-434 Unrestricted upload of file with dangerous type in Roskus Prospero Flow CRM

The vulnerability in Roskus Prospero Flow CRM before version 5.16.0 involves unrestricted upload of files with dangerous types in the product photo upload functionality. The validation mechanism checks only the file content (magic bytes) and excludes certain PHP extensions, but does not restrict other extensions such as HTML. The ProductSaveController::save() method stores the uploaded file using the client-supplied extension in a publicly accessible directory. An attacker with authenticated create product permission can upload a file that begins with an image header but has an HTML extension, causing the file to be served with a text/html content type. This results in first-party stored cross-site scripting (XSS) allowing arbitrary JavaScript execution within the application origin.

An authenticated user with create product permission can exploit this vulnerability to execute arbitrary JavaScript in the context of the application origin. This can lead to stored cross-site scripting attacks, potentially allowing session hijacking, unauthorized actions, or other client-side attacks within the CRM application. The impact is limited to users who have the required permission and requires authentication.

No official fix or patch is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, restrict or monitor users with create product permissions to reduce risk. Consider implementing additional validation on file extensions and storage locations to prevent execution of uploaded files as scripts.