CVE-2026-86285

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

CVE-2026-86285

BookStack versions up to 26.05.2 are affected by an improper access control vulnerability in the Attachment Edit Endpoint , specifically the AttachmentController::getUpdateForm function in app/Uploads/Controllers/AttachmentController.php. The ID argument can be manipulated to bypass permission ch...

CVE-2026-86285 BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

CVE-2026-84695

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

EUVD-2026-69786

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695

BookStack versions before 26.05.4 are affected by a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint , which accepts unvalidated base64 content and stores it without content inspection. Attackers holding editor permissions can upload SVG files containing scripts that...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

EUVD-2026-68105

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450

BookStack before version 26.05.4 is affected by a remote code execution vulnerability in the portable ZIP import functionality. A user with Import Content and Create Books permissions can upload a PHP polyglot file disguised as a book cover. The attacker bypasses image extension validation by emb...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

CVE-2026-67204

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

EUVD-2026-64919

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

CVE-2026-67204

BookStack before 26.05.4 contains a broken access control vulnerability in the Image Gallery API endpoints . The API controller loads any image type without the content-type restrictions enforced by the web controller's gallery and drawio checks. An authenticated user with image-update or image-d...

CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...