CVE-2026-82450— BookStack before 26.05.4 Remote Code Execution via Book Cover
Quick assessment
Affected
bookstackapp bookstack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BookStack 在 26.05.4 之前版本中存在一个远程代码执行（RCE）漏洞，位于便携式 ZIP 导入功能中。拥有“导入内容”和“创建书籍”权限的用户可以上传一个 PHP 多态（polyglot）文件作为书籍封面。攻击者可以通过在 ZIP 归档中嵌入一个带有 文件名的 PHP 文件，从而绕过图像扩展名校验；该文件将被存储在公共 Web 根目录下，并可通过未认证请求执行。
Possible ATT&CK Techniques 2 AI
T1505.001 · SQL Stored Procedures T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82450
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BookStack before 26.05.4 Remote Code Execution via Book Cover
Source: CVE Program / CVE List V5
Vulnerability Description
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bookstackapp | bookstack | 0 ~ 26.05.4 | - |
|
II. Public POCs for CVE-2026-82450
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82450
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82450 (1)
Vendor Advisories for CVE-2026-82450 (1)
Other References for CVE-2026-82450 (1)
IV. Related Vulnerabilities
Same product: bookstack
Same vendor: bookstackapp
-
CVE-2026-67204
BookStack < 26.05.4 Broken Access Control via Image Gallery -
CVE-2026-5484
BookStackApp BookStack Chapter Export ExportFormatter.php ch -
CVE-2023-4624
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack -
CVE-2022-0877
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstac -
CVE-2021-4194
Improper Access Control in bookstackapp/bookstack
Same weakness: CWE-434
-
CVE-2026-14494
Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated A -
CVE-2026-18983
One User Avatar | User Profile Picture <= 2.5.4 - Authentica -
CVE-2026-81931
Unrestricted upload of file with dangerous type in Prospero -
CVE-2026-78274
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary Fil -
CVE-2026-77991
Joomla Extension - joomlaeventmanager.net - Privileged remot
V. Comments for CVE-2026-82450
No comments yet