CVE-2026-84695: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bookstackapp bookstack

CVE-2026-84695 is a stored cross-site scripting vulnerability in BookStack prior to version 26.05.4. The vulnerability exists because the drawing upload endpoint accepts base64-encoded SVG files without validating or sanitizing their content. Malicious SVG files containing embedded scripts can be uploaded by users with editor privileges. When administrators view these images through the image gallery API, the scripts execute in their browsers due to missing content-type validation and absence of CSP headers, potentially leading to session hijacking or other script-based attacks.

An attacker with editor permissions can exploit this vulnerability to execute arbitrary scripts in the context of administrator browsers. This can lead to unauthorized actions performed by administrators, including theft of credentials or session tokens. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation without user interaction beyond the attacker’s own privileges.

A fix is available in BookStack version 26.05.4 and later. Users should upgrade to version 26.05.4 or newer to remediate this vulnerability. Until upgraded, restrict editor permissions carefully and avoid accessing untrusted SVG content through the image gallery API. Implementing content-type validation and Content Security Policy headers can also help mitigate exploitation.