Remote Code Execution in BookStack via Malicious ZIP Import

Executive Summary

BookStack before version 26.05.4 has a remote code execution vulnerability in its ZIP import feature. Users with Import Content and Create Books permissions can upload a PHP file disguised as a book cover by embedding it in a ZIP archive. The PHP file bypasses image validation due to its .php extension and is stored in the public web root. This allows unauthenticated attackers to execute the file remotely.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in BookStack's public web root directories, particularly in uploads or storage folders. Look for recently modified files with .php extensions that may have been uploaded via ZIP imports. Review server access logs for suspicious requests targeting book covers or image endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of the BookStack server by uploading and executing malicious PHP code. This could lead to data theft, unauthorized access, or disruption of services. The impact depends on the server's configuration and the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations using vulnerable BookStack versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade BookStack to version 26.05.4 or later immediately. If upgrading is not possible, disable the ZIP import feature or restrict Import Content and Create Books permissions to trusted users only. Monitor for unauthorized file uploads and remove any suspicious PHP files from the web root.

Useful 0 Not Useful 0