Emanuele Cervelli

**Name of the Vulnerable Software and Affected Versions** BookStack versions prior to 26.05.4 **Description** A stored cross-site scripting issue exists in the drawing upload endpoint. The system accepts unvalidated base64 content and stores it without performing content inspection. Users with editor permissions can upload SVG files containing malicious scripts. These scripts execute in the browser of an administrator when the files are accessed through the image gallery API, which lacks content-type validation and Content Security Policy (CSP) headers—security layers that help detect and mitigate certain types of attacks, including XSS. **Recommendations** Update BookStack to version 26.05.4 or later.