Is CVE-2026-84695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84695 being exploited in the wild.

How severe is CVE-2026-84695?

High severity, with a CVSS score of 8.7, published 2 September 2026.

Which products and versions are affected?

BookStack BookStack before 26.05.4.

Is there a fix for CVE-2026-84695?

A patch was published on 2026-05-04: Fixed in version 26.05.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84695 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84695?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84695: BookStack stored cross-site scripting in drawing upload endpoint

CVE-2026-84695 · Severity: high · CVSS 8.7 · Published 2026-09-02

BookStack is a popular open-source documentation and wiki platform. The vulnerability allows users with editor permissions to upload malicious SVG files through the drawing upload feature, which are then stored and executed in the browsers of administrators and other users when viewed through the image gallery API. This could lead to account compromise, data theft, or unauthorized actions performed on behalf of affected users.

Quick answers

Is CVE-2026-84695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84695 being exploited in the wild.
How severe is CVE-2026-84695?: High severity, with a CVSS score of 8.7, published 2 September 2026.
Which products and versions are affected?: BookStack BookStack before 26.05.4.
Is there a fix for CVE-2026-84695?: A patch was published on 2026-05-04: Fixed in version 26.05.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84695 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84695?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in BookStack versions before 26.05.4. The drawing upload endpoint accepts base64-encoded content without proper validation or sanitization before storage. When SVG files containing embedded JavaScript are uploaded, the malicious scripts are stored as-is and executed in user browsers when the images are accessed through the gallery API, which lacks proper Content-Type headers and CSP (Content Security Policy) protections. The vulnerability requires editor-level permissions to exploit, but the impact is high since the injected scripts execute in the context of any user viewing the gallery, including administrators. The vulnerability was patched in version 26.05.4.

Affected products

BookStack BookStack before 26.05.4

Timeline

2026-09-02: disclosed
2026-05-04: patched: Fixed in version 26.05.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.