CVE-2026-84695
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
BookStack before 26.05.4 Stored XSS via Drawing Upload
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
bookstack
- Vendor
- bookstackapp
- Product
- bookstack
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://github.com/BookStackApp/BookStack
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 26.05.4 | Unavailable | None listed |
| 26.05.4 | unaffected | custom | Unavailable | Unavailable | None listed |