Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck

CVE-2026-82450BookStack before 26.05.4 Remote Code Execution via Book Cover

High 8.8

In plain English

A high-severity unrestricted file upload in bookstack from bookstackapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 37.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

Affected products (as reported)

Vendor	Product	Versions
bookstackapp	bookstack	0 – before 26.05.4

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit patch
https://github.com/BookStackApp/BookStack product
VulnCheck Advisory: BookStack before 26.05.4 Remote Code Execution via Book Cover third-party-advisory