Executive brief
BookCars, an open-source car rental management system, contains a security flaw in how it handles file uploads. An attacker with a user account can upload malicious files to the server because the system does not properly check the type of files being sent. This could allow an attacker to run unauthorized code on the server or launch attacks against other users, potentially leading to data theft or full system compromise.
Technical details
An unrestricted file upload vulnerability exists in BookCars <= v8.3 within the /api/create-license and /api/create-car-image endpoints. The root cause is a lack of file extension validation and content verification in the userController.ts and carController.ts components; the application merely generates a unique filename using nanoid() and preserves the original extension. An authenticated attacker can upload malicious files (such as .html for XSS or potentially server-side executable scripts depending on the environment) to the CDN temporary directory. While the NVD description suggests arbitrary code execution, the technical PoC demonstrates stored Cross-Site Scripting (XSS) by uploading HTML files containing JavaScript. Remediation requires implementing a strict whitelist of allowed extensions and verifying file headers (magic bytes).
Affected products
- BookCars BookCars <= 8.3
Timeline
- 2026-06-09: disclosed: CVE-2026-36722 published