CVE-2026-82450
HighCVSS 8.8Summary
BookStack before version 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
Risk Assessment
The vulnerability allows an unauthenticated attacker to execute arbitrary code on the server, potentially leading to full system compromise and data breach.
Recommendation
Update BookStack to version 26.05.4 or later, which includes the fix; restrict content import permissions.
Other vulnerabilities in BookStack
See all- CVE-2026-67204Medium
Broken access control vulnerability in BookStack before 26.05.4 allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints.
- CVE-2026-5484Medium
A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.