🔥 CyberForge CVE of the Day #038 🚨 CVE-2026-82450 — BookStack Portable ZIP Import to Remote Code Execution BookStack versions before 26.05.4 contain a High-severity authenticated RCE in the portable ZIP importer. A user whose effective roles provide both **Import Content** and **Create Books** can submit an archive whose book cover references a PHP–image polyglot carrying a `.php` extension. Vulnerable BookStack versions do not apply the correct image-specific validation to that imported cover. The dangerous file can consequently reach a web-accessible image location, where a later HTTP request may cause the PHP-capable web stack to execute it with the privileges of the BookStack web-service process. 🔑 Key details: ⭐ Severity: High ⭐ CVSS v4.0: 8.7 — `AV:N/AC:L/AT:N/PR:L/UI:N` ⭐ CVSS v3.1: 8.8 🧠 Weakness: CWE-434 — Unrestricted Upload of File with Dangerous Type 🎯 Target: BookStack portable ZIP importer and book-cover handling 🔓 Authentication: Required 🔐 Permissions: Import Content **and** Create Books 🌐 Attack vector: Network ⚙️ Attack complexity: Low once the required permissions exist 👆 User interaction: None ⚔️ Impact: Remote code execution with High confidentiality, integrity and availability impact 🛡️ Fixed: BookStack 26.05.4 🚫 Public executable PoC: None identified 🚨 Confirmed active exploitation: None identified 📋 CISA KEV: Not listed — checked 31 August 2026 📈 EPSS: 0.572% — approximately 45th percentile ⚔️ The attack chain: 1️⃣ The attacker obtains a valid BookStack account. 2️⃣ Its combined roles provide both Import Content and Create Books. BookStack permissions stack across roles, so the two capabilities need not originate from one role. 3️⃣ The attacker prepares a portable BookStack ZIP whose book-cover reference points to a PHP–image polyglot using a `.php` filename. 4️⃣ The archive is submitted through the authenticated `/import` workflow. 5️⃣ BookStack processes the cover without the correct image-specific validation and stores the dangerous artifact in a web-reachable image path. 6️⃣ The attacker requests the planted file over HTTP. This second request may not require a BookStack session. 7️⃣ The PHP/web server interprets the uploaded file as server-side code, giving the payload the operating-system and application access available to that service account. ⚠️ The crucial distinction: This is not unauthenticated initial access. Importing the malicious archive requires a real account with two confirmed permissions. However, the later request that triggers the planted PHP file can be unauthenticated. That two-stage split explains why the vulnerability can sound pre-auth when only its final execution request is considered. Successful exploitation does not automatically grant root. Code runs as the PHP/web-service identity. Depending on deployment permissions, that may still expose BookStack data, application configuration, database credentials, API or SMTP secrets, writable content and network access to connected services. 🛡️ Affected Software & Versions: * BookStack versions earlier than 26.05.4 * CNA range: `>= 0` and `< 26.05.4` * Official fix: BookStack 26.05.4, released 24 August 2026 * The CVE record was published on 29 August 2026 Containers, appliances, replicas, staging systems and disaster-recovery copies should be checked by their **running BookStack version**, not merely an image tag or package label. 🔧 What the patch changed: BookStack 26.05.4 repairs the archive-to-image trust boundary with multiple layers: ✅ Imported covers now use image-specific validation. ✅ The detected MIME type must match a supported image format. ✅ Supported types are JPEG, PNG, GIF, WebP and AVIF. ✅ The saved extension is derived from detected content instead of trusting the archive filename. ✅ The lower image-storage layer rejects unsupported extensions. ✅ New tests ensure non-image book covers are rejected. The fix therefore aligns content detection, allowed type and stored extension before the file becomes web-reachable. 🧠 The practical attack surface: Risk is highest on internet-facing BookStack instances before 26.05.4 where contractors, authors, migration users, federated groups or other low-trust identities possess the two-permission combination. Public registration alone does not prove exploitability—the role granted to the registered user must still include both capabilities. Defenders should calculate effective permissions across every assigned role, including LDAP/SAML/OIDC group mappings and automated provisioning rules. BookStack's default local image storage uses `public/uploads/images`. Secure local or external object storage and a web-server policy forbidding script execution under upload paths may break or reduce the demonstrated chain, but neither is a substitute for installing the repaired release. 🔎 Defender hunting priorities: 🔹 Inventory every user and role with Import Content + Create Books. 🔹 Review recent role grants, SSO group changes, new accounts, `/import` activity and created books. 🔹 Inspect `public/uploads` and `storage/uploads/images` for `.php`, `.phtml`, `.phar`, double extensions and files whose content does not match the extension. 🔹 Search web and reverse-proxy logs for requests to PHP-like files beneath upload/image paths, especially shortly after ZIP imports. 🔹 Alert when PHP-FPM, Apache or the web-service account spawns shells, PowerShell, `curl`, `wget`, Python or other command/download tools. 🔹 Review unusual outbound connections and credential/configuration-file access from the BookStack workload. 🔹 Preserve suspicious files, hashes, timestamps and logs before containment—do not immediately delete the evidence. If code execution is confirmed, deleting the uploaded file is not enough. Isolate the workload, rebuild it from trusted media, review BookStack content and identities, and rotate application secrets, database credentials and any connected tokens accessible to the service. 🛡️ Defensive action: ✅ Upgrade every BookStack node to 26.05.4 or later. ✅ Verify the running version after updating and clear/restart cached workers where applicable. ✅ Rebuild immutable containers so vulnerable layers cannot return. ✅ Remove either Import Content or Create Books from untrusted users during any unavoidable patch delay. ✅ Restrict `/import` to trusted networks as temporary risk reduction. ✅ Prevent PHP/script execution beneath upload directories as defence-in-depth. ✅ Ensure only BookStack's `public` directory is web-served and run the web process with least privilege. 🚫 Exploitation and PoC status: No credible executable public PoC, confirmed exploitation or CISA KEV listing was identified at the 31 August 2026 research cut-off. The public CNA description and vendor patch reveal enough of the root cause to aid reproduction, but they are technical disclosure—not a ready-to-run exploit. The absence of a weaponised PoC is not a reason to wait. Patch differences are public, and a malicious import can resemble legitimate application activity unless defenders correlate the account, archive, created file and later trigger request. 🔥 CyberForge verdict: CVE-2026-82450 is a proper High-priority RCE wherever untrusted or externally controlled users can reach BookStack's import workflow with both required permissions. It is neither universal pre-auth compromise nor merely an image-upload bug. It is a conditional but clean bridge from a low-privilege content operation to server-side PHP execution. Patch immediately on exposed or multi-user deployments, revoke the dangerous permission combination during any delay, and retrospectively hunt import and upload telemetry. No public PoC and no KEV listing mean **no confirmed public weaponisation yet**—not no danger. 🔗 Full visual/vendor security release: https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/ 🔗 The Hacker Wire Report: https://www.thehackerwire.com/bookstack-rce-via-zip-import-polyglot-cve-2026-82450/ 🔗 CNA technical advisory: https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover 🔗 Security patch: https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6 🔗 Full vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2026-82450 #CyberSecurity #CVE #BookStack #RCE #PHP #FileUpload #AppSec #BlueTeam #ThreatHunting #CyberForge
Post summary
The post discloses a high‑severity authenticated RCE in BookStack via ZIP import, details the vulnerability and attack chain, and cites the official patch, while noting no public PoC or confirmed active exploitation.
