Executive brief
BookStack is a popular open-source documentation and wiki platform used to organize and share information across organizations. The portable ZIP import feature allows users to bulk import content, but versions before 26.05.4 fail to properly validate file types during the import process. An authenticated attacker with Import Content and Create Books permissions can upload a malicious PHP file disguised as a book cover image, which gets stored in the public web directory and executed by any visitor to the site, leading to complete system compromise.
Technical details
The vulnerability is a file upload bypass in the ZIP import functionality that accepts book cover images. The root cause is insufficient validation of file types: while the application checks file extensions, it can be bypassed by embedding a PHP file within a ZIP archive with a .php filename. The vulnerable component is the image storage and ZIP import validation logic. An attacker must have Import Content and Create Books permissions (authenticated attack), but once the malicious file is uploaded to the public web root, it is executed by unauthenticated HTTP requests. The fix, committed on 2026-08-22, enforces MIME type validation and forces file extensions based on actual file types rather than user input. The patch is included in version 26.05.4 and later.
Affected products
- BookStack BookStack before 26.05.4
Timeline
- 2026-08-29: disclosed: CVE-2026-82450 published
- 2026-08-22: patched: Fix committed to development branch (commit e210cc32)