CVE-2026-36722: bookcars v8.3 RCE Vulnerability

CVE-2026-36722 Overview

CVE-2026-36722 is an authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3. Authenticated attackers can upload a crafted file to execute arbitrary code on the application server. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and stems from missing validation of file type, content, and extension on the affected API endpoint. Exploitation requires network access, low privileges, and user interaction, according to the published CVSS vector.

Critical Impact
Authenticated attackers can upload malicious files through /api/create-car-image and execute arbitrary code against bookcars v8.3 deployments.

Affected Products

bookcars v8.3
/api/create-car-image API component
Deployments exposing the bookcars upload endpoint to authenticated users

Discovery Timeline

2026-06-09 - CVE-2026-36722 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36722

Vulnerability Analysis

The vulnerability resides in the /api/create-car-image endpoint of bookcars v8.3, a car rental management application. The endpoint accepts image uploads from authenticated users but fails to enforce strict validation of file content, MIME type, or extension. An attacker can upload a crafted file containing executable server-side code, such as a script disguised as an image. When the uploaded file is later requested or processed by the server, the embedded code executes within the application context. The flaw maps to [CWE-434], a category covering unrestricted upload of files with dangerous types.

Root Cause

The root cause is missing or insufficient input validation on the file upload handler in /api/create-car-image. The endpoint trusts client-supplied filenames and content without verifying that uploaded data matches expected image formats. There is no allowlist of safe extensions, no content-type inspection beyond headers, and no isolation of the upload directory from script execution.

Attack Vector

An attacker first obtains valid credentials to the bookcars application. The attacker then sends a POST request to /api/create-car-image containing a file with a server-executable extension or polyglot content. After the upload succeeds, the attacker accesses the uploaded resource through a predictable path, triggering code execution. The CVSS vector indicates the attack requires user interaction and yields limited confidentiality and integrity impact.

No verified proof-of-concept code is available. Technical details are documented in the GitHub Vulnerability Repository.

Detection Methods for CVE-2026-36722

Indicators of Compromise

Unexpected files with script extensions (.php, .jsp, .js, .html) stored in the bookcars car image upload directory
POST requests to /api/create-car-image containing non-image content types or oversized payloads
Outbound network connections originating from the bookcars application process to unfamiliar hosts following an upload event

Detection Strategies

Inspect web server access logs for POST requests to /api/create-car-image followed by GET requests to newly created files in the image storage path
Compare uploaded file magic bytes against the declared file extension to flag mismatches indicative of disguised payloads
Alert on application processes spawning shell interpreters or unexpected child processes after file upload activity

Monitoring Recommendations

Enable verbose logging on the bookcars API gateway and forward authentication events and upload events to a centralized log platform
Monitor file system changes in the car image upload directory using file integrity monitoring tooling
Track authenticated user sessions for anomalous upload volume or repeated failed validation events

How to Mitigate CVE-2026-36722

Immediate Actions Required

Restrict access to /api/create-car-image to trusted administrative accounts until a patched release is available
Audit the car image upload directory for unexpected files and remove any non-image artifacts
Rotate credentials for any bookcars accounts that may have been used to test or exploit the endpoint

Patch Information

No official vendor patch has been documented in the available references at the time of publication. Monitor the bookcars project repository and project channels for fix releases beyond version 8.3. Apply updates as soon as the maintainer publishes a release that validates uploaded file content and extensions.

Workarounds

Place the bookcars upload directory on a separate path with script execution disabled at the web server layer (for example, by removing handler mappings for .php or .jsp in that location)
Add a reverse proxy or web application firewall rule that rejects uploads to /api/create-car-image whose Content-Type is not an allowlisted image MIME type
Rename uploaded files to randomized identifiers and strip user-supplied extensions before storing them

bash

# Example nginx configuration disabling script execution in the upload directory
location /uploads/cars/ {
    location ~ \.(php|jsp|js|html|phtml|sh|pl|py)$ {
        deny all;
        return 403;
    }
    types {
        image/jpeg jpg jpeg;
        image/png  png;
        image/gif  gif;
    }
    default_type application/octet-stream;
}