CVE-2026-82450: BookStack before 26.05.4 Remote Code Execution via Book Cover
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with both Import Content and Create Books permissions. They can then use the portable ZIP import feature to upload a crafted archive.
Does exploitation require the attacker to be authenticated when triggering code execution?
Authentication is required to upload the malicious ZIP archive, but the uploaded PHP file can subsequently be executed through unauthenticated requests because it is stored in the public web root.
Are all BookStack versions affected?
The issue affects BookStack versions before 26.05.4. Version 26.05.4 is the first version identified as not affected by the provided information.
What should be prioritized if an update cannot be applied immediately?
Restrict Import Content and Create Books permissions to trusted users, since both permissions are required to upload the malicious archive. Review use of the portable ZIP import functionality and limit access to it where possible.