CVE-2026-84695

BookStack versions before 26.05.4 are affected by a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint , which accepts unvalidated base64 content and stores it without content inspection. Attackers holding editor permissions can upload SVG files containing scripts that...