EUVD Vulnerability Catalog
EUVD-2026-69786
Severity: CRITICAL
Base Score: 9.3
CVSS Version: 4.0
Vulnerability Description
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): Passive
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): High
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
BookStackApp
References & Advisory Links
- https://github.com/BookStackApp/BookStack
- https://github.com/BookStackApp/BookStack/commit/ac0348a79f3ddd004ca87703948cb9c7d19a420a
- https://github.com/BookStackApp/BookStack/blob/v26.05.3/app/Uploads/ImageService.php
- https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4
- https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/
- https://www.vulncheck.com/advisories/bookstack-before-26.05.4-stored-xss-via-drawing-upload
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
VulnCheck
EPSS Probability
0
Known Aliases
CVE-2026-84695
Published On
2026-09-02
Last Updated
2026-09-02