CVE-2026-84695 in BookStack
Summary
by MITRE • 09/02/2026
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The identified security flaw resides within the BookStack application prior to version 26.05.4, specifically affecting the drawing upload endpoint which processes base64 encoded content. This vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, where malicious scripts are persistently stored on the target server rather than being executed immediately in a transient context. The core technical deficiency lies in the application's failure to perform adequate input validation and sanitization on uploaded files. Specifically, the system accepts base64 encoded data without inspecting its content type or structure, allowing attackers to bypass standard file extension checks by embedding executable code within SVG (Scalable Vector Graphics) files. Since SVG is an XML-based vector image format that supports scripting via JavaScript, it serves as a potent vehicle for XSS attacks when rendered in modern web browsers.
The operational impact of this vulnerability is significant due to the privilege escalation aspect involved. An attacker who possesses editor permissions within BookStack can upload these maliciously crafted SVG files. Once stored, these files are not merely static images but contain embedded JavaScript payloads that remain dormant until accessed by a user with higher privileges, such as an administrator. When an administrator views or interacts with the image gallery API endpoint to display these drawings, their browser parses and executes the injected script in the context of the BookStack application domain. This execution occurs without sufficient Content Security Policy (CSP) headers to restrict inline script execution, nor is there strict content-type validation on the server side to reject non-image MIME types or dangerous SVG structures. Consequently, this allows for session hijacking, credential theft, defacement of the administrative interface, or further lateral movement within the organization's network if the application has access to sensitive internal resources.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. More specifically, it falls under CWE-831: Action Based CSRF Check Being Bypassed if the upload mechanism relies solely on client-side checks or lacks robust server-side validation of file contents. In terms of offensive security frameworks, this attack vector maps to MITRE ATT&CK technique T1059.007: JavaScript, which describes how attackers use scripting languages to execute malicious actions within a victim's browser environment. The persistence aspect also relates to CWE-436: Interpretation Conflict, where the application interprets an SVG file as both a valid image and executable code due to insufficient sanitization of embedded script tags or event handlers like onload attributes commonly found in crafted SVGs.
To mitigate this vulnerability, immediate patching is required by upgrading BookStack to version 26.05.4 or later, where the developers have addressed these input validation gaps. In addition to software updates, administrators should implement strict server-side file type verification that inspects the actual content of uploaded files rather than relying solely on file extensions or MIME types provided by clients. Implementing a robust Content Security Policy (CSP) with directives such as script-src 'self' can significantly reduce the impact of any remaining XSS vulnerabilities by preventing the execution of inline scripts and unauthorized external sources. Furthermore, enabling strict mode for SVG rendering in browsers where possible and ensuring that image galleries do not automatically render untrusted user-uploaded content without prior sanitization are recommended defensive measures. Regular security audits focusing on file upload mechanisms and continuous monitoring for anomalous script executions will further harden the application against such attacks.