CVE-2026-82450

HIGH 8.8

BookStack before 26.05.4 Remote Code Execution via Book Cover

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

CWE	CWE-434
Vendor	bookstackapp
Product	bookstack
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for bookstackapp bookstack

Be the first to know when new high vulnerabilities affecting bookstackapp bookstack are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

bookstackapp / bookstack

0 < 26.05.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6 github.com: https://github.com/BookStackApp/BookStack vulncheck.com: https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover

Credits

🔍 Submersion.ai Security Research Team