Prospero Flow CRM EUVD-2026-67225

Exploitation requires an active authenticated session with the 'create product' permission, which the description maps to the routine Seller role - this is not an administrative or elevated privilege, meaning any standard sales user qualifies. The attacker must be able to reach the product photo upload endpoint over the network. A second user (victim) with access to the product listing or detail view must load the page containing the maliciously named file; without victim interaction, no JavaScript executes. The attack is limited to the application's own origin (no cross-origin scope change on the server side). Exploitation is bounded to the Prospero Flow CRM web application context and does not affect the underlying server OS or other services. Non-default conditions are not required beyond holding a Seller account, which is a standard CRM user role.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) produces a score of 4.8, reflecting medium severity moderated by two significant prerequisites: the attacker must hold an authenticated Seller role (PR:L) and a victim user must actively view the product listing or detail page (UI:A). No EPSS score was provided in the source data and cannot be independently stated. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. The CVSS 4.0 downstream-system integrity impact (SI:L) appropriately captures that the JavaScript executes in the application origin, enabling session hijacking or data exfiltration from other authenticated users. The supplied CVSS 4.0 vector sets SC:N, which understates the cross-user impact; an argument exists for SC:L/SI:L given that the script executes in arbitrary victims' browser sessions. Overall real-world risk is moderate for multi-tenant CRM deployments where untrusted Seller accounts exist; the authentication barrier makes mass exploitation implausible and targeted insider misuse or compromised Seller credentials the realistic threat path.

An attacker authenticates to the CRM with a legitimate Seller account (or a compromised one), crafts a file that begins with a valid JPEG magic-byte sequence (FF D8 FF) but is named payload.html and contains an HTML body with an embedded script tag. The file passes the server's image/mimes validation because the content check sees image bytes, but the stored filename becomes <uuid>.html and is accessible at a predictable URL under public/asset/upload/product/. When any other authenticated user browses the product listing or detail page that references this photo, the browser fetches the .html file, renders it as a document in the application origin, and executes the attacker's JavaScript - enabling session cookie theft, credential phishing overlays, or account takeover actions on behalf of the victim.