CVE-2026-82450: BookStack before 26.05.4 Remote Code Execution via Book Cover

Q: Who can exploit this issue?

An attacker needs an account with both Import Content and Create Books permissions. They can then use the portable ZIP import feature to upload a crafted archive.

Q: Does exploitation require the attacker to be authenticated when triggering code execution?

Authentication is required to upload the malicious ZIP archive, but the uploaded PHP file can subsequently be executed through unauthenticated requests because it is stored in the public web root.

Q: Are all BookStack versions affected?

The issue affects BookStack versions before 26.05.4. Version 26.05.4 is the first version identified as not affected by the provided information.

Q: What should be prioritized if an update cannot be applied immediately?

Restrict Import Content and Create Books permissions to trusted users, since both permissions are required to upload the malicious archive. Review use of the portable ZIP import functionality and limit access to it where possible.

Published Aug 29, 2026

Updated

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

Affected Software

1 affected component

BookStack BookStack<26.05.4

Event History

Aug 29, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an account with both Import Content and Create Books permissions. They can then use the portable ZIP import feature to upload a crafted archive.

Does exploitation require the attacker to be authenticated when triggering code execution?

Authentication is required to upload the malicious ZIP archive, but the uploaded PHP file can subsequently be executed through unauthenticated requests because it is stored in the public web root.

Are all BookStack versions affected?

The issue affects BookStack versions before 26.05.4. Version 26.05.4 is the first version identified as not affected by the provided information.

What should be prioritized if an update cannot be applied immediately?

Restrict Import Content and Create Books permissions to trusted users, since both permissions are required to upload the malicious archive. Review use of the portable ZIP import functionality and limit access to it where possible.

CVE-2026-82450: BookStack before 26.05.4 Remote Code Execution via Book Cover

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require the attacker to be authenticated when triggering code execution?

Are all BookStack versions affected?

What should be prioritized if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require the attacker to be authenticated when triggering code execution?

Are all BookStack versions affected?

What should be prioritized if an update cannot be applied immediately?