Description

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-29T14:16:37.930Z",
  "pubdate": "2026-08-29T14:16:37.930Z",
  "executiveSummary": "BookStack versions prior to 26.05.4 are susceptible to a Remote Code Execution (RCE) vulnerability within the portable ZIP import functionality.\nThe flaw allows authenticated users with specific permissions—'Import Content' and 'Create Books'—to bypass security validation by crafting a malicious ZIP archive.\nBy embedding a PHP polyglot file, an attacker can trick the system into storing executable code within the public web directory.\nOnce uploaded, the file is accessible via direct, unauthenticated HTTP requests, leading to server-side code execution.\nThis vulnerability poses a critical risk to the confidentiality, integrity, and availability of the host server, as it provides a path for full system compromise.\nExploitation requires authenticated access to the application, specifically the ZIP import module, but bypasses further extension validation mechanisms.",
  "technicalDetails": "The vulnerability resides in the application's handling of portable ZIP imports, where file validation mechanisms fail to adequately sanitize archive contents before storage.\nThe root cause is a failure in the validation logic to enforce strict file type restrictions for assets contained within uploaded ZIP archives, specifically regarding book covers.\nAn attacker can exploit this by creating a PHP polyglot file—a file that functions as both a valid image and a valid PHP script—and assigning it a .php file extension within the structure of the ZIP archive.\nDuring the import process, the application extracts these files to the public web root. Because the application logic fails to re-validate the extensions of these internal files or move them to a non-executable directory, the file is saved in a location where the web server interprets it as executable content.\nThe attack flow proceeds as follows: First, the attacker authenticates as a user with 'Import Content' and 'Create Books' privileges. Second, the attacker uploads a ZIP file containing the polyglot PHP file. Third, the application processes the ZIP, extracting the malicious payload into the public document root. Finally, the attacker triggers execution by sending an unauthenticated HTTP GET request directly to the path where the PHP file was stored.\nThis results in arbitrary command execution on the underlying operating system with the privileges of the web server user (e.g., www-data).\nAffected versions include all iterations of BookStack prior to 26.05.4. The exposure is categorized as high risk due to the potential for full environment takeover and subsequent lateral movement within the network infrastructure.\nThe lack of server-side sanitization on the file extension during extraction allows the bypass, rendering the standard image-upload filter ineffective against structured ZIP payloads."
}