CVE-2026-81931: CWE-434 Unrestricted upload of file with dangerous type in Roskus Prospero Flow CRM

This vulnerability (CWE-434) in Roskus Prospero Flow CRM before 5.16.0 involves unrestricted upload of files with dangerous types via the product photo upload feature. The system validates files based on magic bytes and excludes only a fixed list of PHP extensions, but does not restrict other extensions such as HTML. The ProductSaveController::save() method stores the uploaded file using the client-supplied extension in the public web root directory (public/asset/upload/product/). An attacker with create product permission (typically a Seller role) can upload a file starting with an image header but with an HTML extension, which passes validation and is served with a text/html content type. This results in first-party stored script execution, allowing arbitrary JavaScript execution within the application's origin.

An authenticated user with create product permission can exploit this vulnerability to execute arbitrary JavaScript in the context of the application origin. This can lead to potential cross-site scripting (XSS) attacks, enabling actions such as session hijacking, unauthorized actions, or data theft within the application. The vulnerability does not require elevated privileges beyond the create product permission and does not require user interaction beyond authentication.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the create product permission to trusted users only and monitor uploads for suspicious file extensions. Consider implementing additional server-side validation to reject files with dangerous extensions beyond PHP, especially HTML or script-related extensions. Avoid serving uploaded files from public web directories without proper content-type restrictions or sanitization.