CVE-2026-84695criticalCWE-79

CVE-2026-84695: critical vulnerability in bookstackapp bookstack

BookStack before 26.05.4 Stored XSS via Drawing Upload

Published

Follow this CVE+ Monitor BookStack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
bookstackapp · bookstack
Related CVEs — bookstackapp bookstack

In the same product, most dangerous first.

CVE-2026-82450HIGHBookStack before 26.05.4 Remote Code Execution via Book CoverEPSS 1.0%CVE-2026-89022CRITICALBookStack < 26.05.5 Authentication Bypass via Social Login Provider ConfusionEPSS 0.5%