Description

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-02T01:17:24.400Z",
  "pubdate": "2026-09-02T01:17:24.400Z",
  "executiveSummary": "BookStack versions prior to 26.05.4 are susceptible to a stored cross-site scripting (XSS) vulnerability located within the drawing upload mechanism.\nThe vulnerability originates from the application's failure to perform adequate input validation and sanitization on base64-encoded SVG file uploads.\nThe lack of enforced content-type validation and the absence of robust Content Security Policy (CSP) headers allow malicious actors to inject arbitrary JavaScript payloads into the system.\nAn attacker possessing editor-level privileges can upload crafted SVG files to the image gallery API; these payloads execute within the security context of an administrator's browser upon viewing the gallery.\nThis exploit poses a significant risk, potentially leading to unauthorized administrative actions, session hijacking, or exfiltration of sensitive platform data.\nSuccessful exploitation requires authenticated access with editor permissions, representing a privilege escalation risk where a low-privileged user can compromise high-privileged accounts.",
  "technicalDetails": "The vulnerability resides in the drawing upload endpoint, which processes base64-encoded content intended for image storage. The application accepts these uploads without inspecting the structural integrity or the content of the decoded file.\nBecause the system does not validate the MIME type of the uploaded content, an attacker can submit a file disguised as a drawing that is, in fact, a malicious SVG containing embedded <script> tags or event handlers (e.g., onload).\nThe application stores these malicious files directly on the server. When an administrator accesses the image gallery API, the browser interprets the stored SVG content as an image resource. Because the system fails to apply restrictive CSP headers, the browser executes the embedded JavaScript within the origin of the BookStack application.\nThe attack flow follows a structured path: first, the attacker authenticates as an editor and crafts an SVG payload designed to execute arbitrary code. Second, the attacker invokes the drawing upload endpoint to push the malicious base64 content. Third, the payload remains dormant within the storage layer until an administrator triggers the vulnerability by accessing the image gallery API to view or manage uploaded drawings.\nThe technical root cause is the reliance on implicit trust of user-submitted base64 data, coupled with a lack of server-side sanitization and missing browser-level security headers that would otherwise prevent the execution of untrusted scripts in a document context. The impact of this stored XSS is elevated due to the execution environment being the administrator's authenticated session, allowing for full client-side control over the administrative interface, including the potential to manipulate configurations, create unauthorized users, or steal session identifiers."
}