The vulnerability identified as CVE-2026-78337 affects Roskus Prospero Flow CRM versions prior to 5.15.13. It involves an unrestricted file upload flaw in the company logo upload feature, where authenticated users with specific permissions can upload SVG files containing embedded script elements. This results in the execution of arbitrary JavaScript code in the context of the application origin, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). No patch or official remediation information is provided in the available data.

An authenticated user with create and update company permissions can exploit this vulnerability to execute arbitrary JavaScript code in the application's origin. This could potentially lead to actions such as session hijacking, unauthorized actions within the application, or other client-side attacks relying on script execution. However, the impact is limited to users who already have these permissions and requires user interaction (UI:A).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the permissions for users who can upload company logos and avoid uploading SVG files with embedded scripts. Consider implementing file type validation and sanitization on the server side to prevent dangerous file uploads.