# CVE-2026-82450: BookStack remote code execution in ZIP import

Source: https://junglewise.ai/threats/cve-2026-82450-bookstack-remote-code-execution-in-zip-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82450 · Severity: high · CVSS 8.8 · Published 2026-08-29

BookStack is a popular open-source documentation and wiki platform used to organize and share information across organizations. The portable ZIP import feature allows users to bulk import content, but versions before 26.05.4 fail to properly validate file types during the import process. An authenticated attacker with Import Content and Create Books permissions can upload a malicious PHP file disguised as a book cover image, which gets stored in the public web directory and executed by any visitor to the site, leading to complete system compromise.

## Quick answers

**Is CVE-2026-82450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82450 being exploited in the wild.

**How severe is CVE-2026-82450?** High severity, with a CVSS score of 8.8, published 29 August 2026.

**Which products and versions are affected?** BookStack BookStack before 26.05.4.

**Is there a fix for CVE-2026-82450?** A patch was published on 2026-08-22: Fix committed to development branch (commit e210cc32) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82450 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82450?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a file upload bypass in the ZIP import functionality that accepts book cover images. The root cause is insufficient validation of file types: while the application checks file extensions, it can be bypassed by embedding a PHP file within a ZIP archive with a .php filename. The vulnerable component is the image storage and ZIP import validation logic. An attacker must have Import Content and Create Books permissions (authenticated attack), but once the malicious file is uploaded to the public web root, it is executed by unauthenticated HTTP requests. The fix, committed on 2026-08-22, enforces MIME type validation and forces file extensions based on actual file types rather than user input. The patch is included in version 26.05.4 and later.

## Affected products

- BookStack BookStack before 26.05.4

## Timeline

- 2026-08-29: disclosed: CVE-2026-82450 published
- 2026-08-22: patched: Fix committed to development branch (commit e210cc32)

## References

- [https://github.com/BookStackApp/BookStack](https://github.com/BookStackApp/BookStack)
- [https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6](https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6)