An authenticated user holding the create product permission can upload a file that begins with an image header but carries an HTML extension. The upload routine validates only the file’s magic bytes and rejects a fixed list of PHP extensions, then copies the file into the web root using the client‑supplied extension. The resulting file is served with a text/html content type, allowing arbitrary JavaScript to execute within the application context.

Prospero Flow CRM from Roskus. Versions prior to 5.16.0 are vulnerable. The issue affects the product photo upload functionality accessed by users with Seller role permissions.

The CVSS score of 4.8 reflects moderate impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and possess create product privileges. Once a malicious file is stored, the application will serve it as a script, enabling stored cross‑site scripting attacks against all users who view product pages.