CVE-2026-84695— BookStack before 26.05.4 Stored XSS via Drawing Upload
Quick assessment
Affected
bookstackapp bookstack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BookStack 在 26.05.4 之前版本中存在一个存储型跨站脚本（Stored XSS）漏洞，位于绘图上传端点（drawing upload endpoint）。该端点接受未经校验的 Base64 编码内容，并在未进行内容检查的情况下将其存储。拥有编辑权限的攻击者可以上传包含脚本的 SVG 文件，当管理员通过图片库 API（image gallery API）访问这些文件时，由于缺少内容类型（content-type）验证或缺少内容安全策略（CSP）头部，脚本会在管理员的浏览器中执行。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84695
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BookStack before 26.05.4 Stored XSS via Drawing Upload
Source: CVE Program / CVE List V5
Vulnerability Description
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bookstackapp | bookstack | 0 ~ 26.05.4 | - |
|
II. Public POCs for CVE-2026-84695
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84695
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-84695 (1)
Vendor Pages for CVE-2026-84695 (1)
Other References for CVE-2026-84695 (1)
Other References for CVE-2026-84695 (3)
-
https://github.com/BookStackApp/BookStack/blob/v26.05.3/app/Uploads/ImageService.php technical-description
IV. Related Vulnerabilities
Same product: bookstack
-
CVE-2026-82450
BookStack before 26.05.4 Remote Code Execution via Book Cove -
CVE-2026-67204
BookStack < 26.05.4 Broken Access Control via Image Gallery -
CVE-2026-5484
BookStackApp BookStack Chapter Export ExportFormatter.php ch -
CVE-2023-6199
Book Stack v23.10.2 - LFR via Blind SSRF -
CVE-2022-40690
BookStack 跨站脚本漏洞
Same vendor: bookstackapp
-
CVE-2026-82450
BookStack before 26.05.4 Remote Code Execution via Book Cove -
CVE-2026-67204
BookStack < 26.05.4 Broken Access Control via Image Gallery -
CVE-2026-5484
BookStackApp BookStack Chapter Export ExportFormatter.php ch -
CVE-2023-4624
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack -
CVE-2022-0877
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstac
Same weakness: CWE-79
-
CVE-2026-84437
OpenCart Autocomplete Workflow address.php cross site script -
CVE-2026-84701
NocoBase Rich Text Field Stored Cross-Site Scripting via API -
CVE-2026-84477
AVideo Stored XSS via Live Schedule Title Description -
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-polic -
CVE-2026-84370
SVGO: removeScripts allows executable links through namespac
V. Comments for CVE-2026-84695
No comments yet