CVE-2026-84695CWE-79cross-site-scripting

CVE-2026-84695

High · published September 2, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-02T05:17Z
References (6)
https://github.com/BookStackApp/BookStack · [email protected]https://github.com/BookStackApp/BookStack/blob/v26.05.3/app/Uploads/ImageService.php · [email protected]https://github.com/BookStackApp/BookStack/commit/ac0348a79f3ddd004ca87703948cb9c7d19a420a · [email protected]https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4 · [email protected]https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/ · [email protected]https://www.vulncheck.com/advisories/bookstack-before-26.05.4-stored-xss-via-drawing-upload · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 02 SEP 00:37Z
    BookStack before 26.05.4 Stored XSS via Drawing Upload
    cvelistv5