What is GHSA-rfhp-pmfg-hj92?

GHSA-rfhp-pmfg-hj92 is a security advisory published by GitHub Security Advisories with Medium severity. Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero...

Which CVE IDs does GHSA-rfhp-pmfg-hj92 cover?

GHSA-rfhp-pmfg-hj92 covers the following CVE IDs: CVE-2026-78337. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rfhp-pmfg-hj92Medium

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero...

Vendor

GitHub Security Advisories

Published

August 24, 2026

Last Modified

August 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-78337 →

📋 Description

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-78337
https://github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17
https://secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xss
https://github.com/advisories/GHSA-rfhp-pmfg-hj92