CVE-2026-82450

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4

Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot file—a file that is valid as both an image and a PHP script—as a book cover. The application fails to apply correct image-specific validation to the imported cover, allowing a file with a .php extension to be stored in a web-accessible directory. An attacker can then trigger the execution of this file via an unauthenticated HTTP request, running code with the privileges of the BookStack web-service process.

The attack occurs through the /import endpoint.

Recommendations Update BookStack to version 26.05.4 or later. As a temporary mitigation, remove either the Import Content or Create Books permission from untrusted users. Restrict access to the /import endpoint to trusted networks. Configure the web server to prevent PHP or script execution within upload directories.