Threat Intelligence Database

CVE-2026-86285 is a medium severity vulnerability in BookStack versions 26.05.0, 26.05.1, and 26.05.2. It involves improper access controls in the AttachmentController::getUpdateForm function, allowing remote attackers to manipulate the ID argument to bypass access restrictions. A patch identified by commit 4e406c41c4c8060a5795e74c66fb96362e54f400 is available to address this issue.

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.