CVE-2026-81931 Roskus CVE debrief

Who should care

Administrators and users of Roskus Prospero Flow CRM, especially those with create product permissions, should be aware of this vulnerability and take necessary actions to protect their systems.

Technical summary

The product photo upload feature in Roskus Prospero Flow CRM before 5.16.0 allows authenticated users with create product permission to upload files with dangerous types. The validation rule checks only the file's magic bytes and rejects a fixed list of PHP extensions. If a file starts with an image header and has an HTML extension, it passes validation and is stored under public/asset/upload/product/. The file is served with a text/html content type, enabling the execution of arbitrary JavaScript in the application's origin.

Defensive priority

Authenticated users with create product permission may be able to execute arbitrary JavaScript; verify and restrict product photo upload permissions.

Recommended defensive actions

• Verify and restrict product photo upload permissions to trusted users.
• Implement additional validation for uploaded files beyond magic bytes and PHP extensions.
• Serve uploaded files with correct content types to prevent script execution.
• Monitor for suspicious product photo uploads and JavaScript execution attempts.
• Update Roskus Prospero Flow CRM to version 5.16.0 or later.

Evidence notes

The CVE description indicates an issue with unrestricted file upload in Roskus Prospero Flow CRM before 5.16.0; an authenticated user can execute arbitrary JavaScript. The photo validation rule only checks file content and rejects a fixed list of PHP extensions. The stored file is served with a text/html content type, enabling script execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.