Executive brief
BookStack is a popular open-source documentation and wiki platform. The vulnerability allows users with editor permissions to upload malicious SVG files through the drawing upload feature, which are then stored and executed in the browsers of administrators and other users when viewed through the image gallery API. This could lead to account compromise, data theft, or unauthorized actions performed on behalf of affected users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in BookStack versions before 26.05.4. The drawing upload endpoint accepts base64-encoded content without proper validation or sanitization before storage. When SVG files containing embedded JavaScript are uploaded, the malicious scripts are stored as-is and executed in user browsers when the images are accessed through the gallery API, which lacks proper Content-Type headers and CSP (Content Security Policy) protections. The vulnerability requires editor-level permissions to exploit, but the impact is high since the injected scripts execute in the context of any user viewing the gallery, including administrators. The vulnerability was patched in version 26.05.4.
Affected products
- BookStack BookStack before 26.05.4
Timeline
- 2026-09-02: disclosed
- 2026-05-04: patched: Fixed in version 26.05.4