CVE-2026-84695: BookStack before 26.05.4 Stored XSS via Drawing Upload
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
BookStack instances before 26.05.4 are exposed when users with editor permissions can use the drawing upload endpoint. The stored payload affects administrators who access it through the image gallery API.
What access does an attacker need to exploit it?
An attacker needs editor permissions and must convince an administrator to access the malicious uploaded SVG through the image gallery API. Exploitation does not require user interaction beyond the administrator accessing that content.
Are default protections sufficient to prevent exploitation?
The affected behavior stores unvalidated base64 drawing content without content inspection. The description also identifies missing content-type validation and CSP headers in the image-gallery access path, so those protections are not present in the vulnerable configuration.
What should be prioritized if an immediate upgrade is not possible?
Restrict editor permissions, especially for untrusted users, and prevent administrator access to untrusted drawing uploads through the image gallery API. Review uploaded SVG drawing content for embedded scripts because malicious content may already be stored.