Login Request a demo
High severity · published Sep 2, 2026
CVE-2026-84695
BookStack before 26.05.4 Stored XSS via Drawing Upload
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bookstack · bookstackapp
before 26.05.4 · source: vendor
Affected product
BO
bookstack
bookstackapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-84695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-84695
github.com
https://github.com/BookStackApp/BookStack
github.com
https://github.com/BookStackApp/BookStack/blob/v26.05.3/app/Uploads/ImageService.php
github.com
https://github.com/BookStackApp/BookStack/commit/ac0348a79f3ddd004ca87703948cb9c7d19a420a
github.com
https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4
www.bookstackapp.com
https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/
www.vulncheck.com
https://www.vulncheck.com/advisories/bookstack-before-26.05.4-stored-xss-via-drawing-upload
More from bookstack
9.8
CVE-2021-4119
bookstack is vulnerable to Improper Access Control
8.8
CVE-2026-82450
BookStack before 26.05.4 Remote Code Execution via Book Cover
8.8
CVE-2020-5256
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system…
8.7
CVE-2020-26211
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would…
8.7
CVE-2020-26210
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the…