CVE-2026-82450 in BookStack
Summary
by MITRE • 08/29/2026
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The vulnerability identified in BookStack versions prior to 26.05.4 represents a critical remote code execution flaw rooted in insecure handling of user-uploaded content within the portable ZIP import functionality. This security defect specifically affects users who possess Import Content and Create Books permissions, allowing them to manipulate how files are processed and stored by the application. The core issue lies in the failure to adequately validate file types during the extraction phase of a ZIP archive intended for book cover images. Instead of strictly enforcing that uploaded assets conform to expected image formats such as JPEG or PNG, the system permits the inclusion of arbitrary executable scripts within the archive structure.
Attackers can exploit this weakness by crafting a malicious ZIP archive containing a PHP polyglot file disguised with a .php extension rather than an image extension. By embedding this script inside the archive and submitting it through the import interface, the attacker bypasses standard client-side or server-side validation checks that typically restrict uploads to non-executable media files. The application extracts the contents of the ZIP file without sufficient sanitization, placing the malicious PHP file directly into a public-facing web root directory designated for storing book covers. This placement is particularly dangerous because it grants direct HTTP access to the uploaded script from any unauthenticated user on the network or internet.
Once the malicious file resides in the accessible web directory, an attacker can trigger its execution by sending specific requests to the URL path associated with that cover image. Because PHP files are interpreted and executed by the server upon request rather than merely displayed as static content, this mechanism provides a persistent backdoor into the underlying system. The resulting remote code execution allows the adversary to run arbitrary commands with the privileges of the web server process, potentially leading full compromise of the host operating system, theft of sensitive data stored within BookStack or connected databases, and lateral movement across internal networks. This type of attack vector is classified under CWE-434 which concerns the unrestricted upload of files with dangerous types, highlighting the fundamental failure in input validation and file handling procedures.
From a threat intelligence perspective, this vulnerability aligns closely with MITRE ATT&CK techniques related to Initial Access via Web Applications and Execution through Command and Scripting Interpreters. The ability to upload and execute arbitrary code without authentication underscores severe deficiencies in access control verification during the import workflow. To mitigate this risk, organizations running BookStack must immediately upgrade to version 26.05.4 or later where these validation checks have been hardened. In environments where upgrading is not instantly feasible, administrators should restrict Import Content permissions to only those users who are strictly trusted and monitored. Additionally implementing strict file type verification on the server side that rejects any non-image MIME types regardless of extension can provide a temporary layer of defense against similar upload-based attacks until the software patch is applied.