CVE-2026-84695criticalCWE-79

CVE-2026-84695: fallo crítico en bookstackapp bookstack

BookStack before 26.05.4 Stored XSS via Drawing Upload

Publicada el

Seguir esta CVE+ Monitorear BookStack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.5%
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Productos afectados
bookstackapp · bookstack
CVEs relacionadas — bookstackapp bookstack

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-82450HIGHBookStack before 26.05.4 Remote Code Execution via Book CoverEPSS 1.0%CVE-2026-89022CRITICALBookStack < 26.05.5 Authentication Bypass via Social Login Provider ConfusionEPSS 0.5%