CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability (CWE-434, unrestricted file upload) in its portable ZIP import functionality. A user who holds both the Import Content and Create Books permissions can upload a crafted PHP polyglot file as a book cover; because image extension validation can be bypassed by embedding a PHP file with a .php filename inside the ZIP archive, the file is written into the public web root. Any unauthenticated request to that stored .php file then executes attacker-controlled PHP code on the server with the web server's privileges, yielding full code execution (high impact to confidentiality, integrity, and availability per the CVSS 4.0 score of 8.7). All BookStack deployments running versions prior to 26.05.4 are affected. There is currently no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.6%, so no confirmed in-the-wild exploitation is known.

What to do: Upgrade BookStack to 26.05.4 or later. Until patched, restrict Import Content and Create Books permissions to trusted users and audit the public web root (including book cover upload directories) for unexpected .php or polyglot files, removing any found and checking web/server logs for requests to them.