CVE-2026-81931 json
Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
published 2mo ago modified 2mo ago also EUVD-2026-67225
- cvss
- 4.8
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.
Patch / fix
Is CVE-2026-81931 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Roskus Prospero Flow CRM
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
github.com
/Roskus/prospero-flow-crm/commit/71b20e1a37f4381d1b8b0a6933a942324e1cc19f
patch
-
secur0.com
/en/cna/cve-list/cve-2026-81931-unrestricted-upload-product-photo-extension-confusion-xss
third-party-advisory, technical-description
Sources
- CVE List CVE-2026-81931
- NVD CVE-2026-81931
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.