Vulnerability Description
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/BookStackApp/BookStack
- https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e
- https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execut
FAQ
What is CVE-2026-82450?
CVE-2026-82450 is a vulnerability with a CVSS score of 8.8 (HIGH). BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP poly...
How severe is CVE-2026-82450?
CVE-2026-82450 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82450?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.