CVE-2026-84695
Received Received - Intake

Stored XSS in BookStack via SVG Drawing Upload

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84695
EUVD
EUVD-2026-69786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookstack bookstack to 26.05.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in BookStack versions before 26.05.4. Attackers with editor permissions can upload SVG files containing malicious scripts via the drawing upload endpoint. The files are stored without validation, and when accessed through the image gallery API, the scripts execute in administrator browsers due to missing content-type validation and CSP headers.

Detection Guidance

Check for unexpected non-image files in BookStack's image upload folders. Use commands like 'find /path/to/uploads -type f ! -name "*.[iI][mM][gG]" ! -name "*.[sS][vV][gG]" -ls' to list non-image files. Review SVG files for embedded scripts and verify content-type headers in responses.

Impact Analysis

If exploited, this vulnerability allows attackers to execute malicious scripts in the browsers of administrators viewing the image gallery. This could lead to unauthorized access, data theft, or further compromise of the BookStack instance. Systems with untrusted editors are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties if such vulnerabilities are exploited due to inadequate security measures.

Mitigation Strategies

Upgrade BookStack to version 26.05.4 or later immediately. Remove any suspicious SVG or non-image files from upload directories. Implement strict content-type validation for uploaded files. Ensure CSP headers are enforced on all responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart