Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-84695 BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it wit… https://www.cve.org/CVERecord?id=CVE-2026-84695
Post summary
The post announces CVE‑2026‑84695, detailing a stored XSS vulnerability in BookStack’s drawing upload endpoint, with technical specifics but no PoC, exploit code, or evidence of active exploitation.
Warning: Critical cross-site scripting vulnerability in #BookStack. CVE-2026-84695 CVSS: 9.3. Attackers with edit permissions can upload SVGs with scripts that get executed when accessed by an admin. This and other vulnerabilities in: https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/ #Patch #Patch #Patch
Post summary
A critical XSS flaw (CVE‑2026‑84695) lets attackers with edit rights run arbitrary scripts via SVG uploads; patches are available in the BookStack release notes.