CVE-2026-82450: BookStack Portable ZIP Import RCE Vulnerability

CVE-2026-82450 Overview

CVE-2026-82450 is a remote code execution vulnerability in BookStack before version 26.05.4. The flaw resides in the portable ZIP import functionality, which fails to validate that files declared as book covers are actual images. Authenticated users with Import Content and Create Books permissions can upload a PHP polyglot inside a ZIP archive and reference it as a book cover. The application writes the file to the public web root, where unauthenticated attackers can request and execute it. The weakness is tracked as CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Low-privileged authenticated users can achieve remote code execution on the underlying web server, enabling full compromise of the BookStack host and its data.

Affected Products

• BookStack versions prior to 26.05.4
• Self-hosted BookStack instances with Import Content and Create Books permissions enabled
• Deployments exposing the public web root to unauthenticated HTTP requests

Discovery Timeline

• 2026-08-29 - CVE-2026-82450 published to NVD
• 2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82450

Vulnerability Analysis

BookStack supports importing content through portable ZIP archives that bundle book metadata, pages, and referenced media. The import validator classified referenced files using a generic fileReferenceRule() rather than verifying image content. Attackers craft a ZIP containing a PHP file with a .php extension and reference it in the manifest as the book cover field. When the import runs, the file is copied into a publicly accessible directory under the web root. A subsequent unauthenticated HTTP request to the stored PHP file causes the web server to execute attacker-controlled code.

Root Cause

The root cause is missing type enforcement on the cover and image file fields during ZIP import validation. The pre-patch code relied on MIME hints and a generic file reference rule, which the attacker bypasses by supplying a PHP polyglot with a .php filename. The patch replaces the generic rule with imageFileReferenceRule(), enforcing image-only validation and blocking non-image extensions from being written to disk.

Attack Vector

The attack requires a valid BookStack account with Import Content and Create Books permissions. An attacker builds a ZIP archive containing a manifest that references a .php file as the book cover. After importing the ZIP through the BookStack UI or API, the malicious file lands in the public uploads directory. The attacker then issues a direct HTTP request to the stored path, causing PHP execution under the web server user.

// Patch: app/Exports/ZipExports/Models/ZipExportBook.php
            'id'    => ['nullable', 'int', $context->uniqueIdRule('book')],
            'name'  => ['required', 'string', 'min:1'],
            'description_html' => ['nullable', 'string'],
-            'cover' => ['nullable', 'string', $context->fileReferenceRule()],
+            'cover' => ['nullable', 'string', $context->imageFileReferenceRule()],
            'tags' => ['array'],
            'pages' => ['array'],
            'chapters' => ['array'],

Source: BookStack commit e210cc32

// Patch: app/Exports/ZipExports/Models/ZipExportImage.php
    public static function validate(ZipValidationHelper $context, array $data): array
    {
-        $acceptedImageTypes = ['image/png', 'image/jpeg', 'image/gif', 'image/webp'];
        $rules = [
            'id'    => ['nullable', 'int', $context->uniqueIdRule('image')],
            'name'  => ['required', 'string', 'min:1'],
-            'file'  => ['required', 'string', $context->fileReferenceRule($acceptedImageTypes)],
+            'file'  => ['required', 'string', $context->imageFileReferenceRule()],
            'type'  => ['required', 'string', Rule::in(['gallery', 'drawio'])],
        ];

Source: BookStack commit e210cc32

Detection Methods for CVE-2026-82450

Indicators of Compromise

• Files with .php, .phtml, or .phar extensions inside the BookStack public/uploads/images/ directory tree.
• Unauthenticated HTTP GET or POST requests to newly created PHP files under /uploads/ paths returning 200 OK.
• BookStack audit log entries showing ZIP imports followed shortly by outbound network connections from the PHP-FPM or web server process.
• Web server processes spawning shells (sh, bash, nc) or writing to /tmp after a book import event.

Detection Strategies

• Inspect ZIP import artifacts by scanning uploaded archives for non-image extensions before extraction on a staging host.
• Alert on file writes of PHP files into any directory served by the web root, correlated with the BookStack service account.
• Correlate BookStack application logs for import actions with subsequent file creations and HTTP access to those files.

Monitoring Recommendations

• Enable and centralize BookStack application audit logs, focusing on import and permission-change events.
• Monitor web access logs for requests to .php resources located under user-content directories such as /uploads/.
• Track process lineage of the web server user to detect unexpected shell or interpreter execution following import activity.

How to Mitigate CVE-2026-82450

Immediate Actions Required

• Upgrade BookStack to version 26.05.4 or later immediately.
• Audit user accounts and remove Import Content and Create Books permissions from any role that does not strictly require them.
• Review the public uploads directory for unexpected PHP files and remove or quarantine any that are found.
• Rotate application secrets, database credentials, and API keys if evidence of exploitation is present.

Patch Information

The fix is committed in BookStack commit e210cc32 and shipped in BookStack 26.05.4. The patch replaces the generic file reference validation with imageFileReferenceRule() for both the book cover field and the image file field, blocking non-image uploads during ZIP import. See the VulnCheck advisory for additional context.

Workarounds

• Restrict the Import Content and Create Books permissions to trusted administrators until the patch is applied.
• Configure the web server to deny PHP execution within the BookStack public uploads directory.
• Place BookStack behind a web application firewall rule that blocks HTTP requests to .php resources under /uploads/ paths.

# Nginx: block PHP execution under BookStack public uploads
location ~* ^/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}