---
id: CVE-2026-84695
title: >-
  BookStack before 26.05.4 contains a stored cross-site scripting vulnerability
  in the drawing upload endpoint that accepts unvalidated base64 content and
  stores it without content inspection
summary: >-
  BookStack before 26.05.4 contains a stored cross-site scripting vulnerability
  in the drawing upload endpoint that accepts unvalidated base64 content and
  stores it without content inspection. Attackers with editor permissions can
  upload S…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-09-02'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84695'
references:
  - url: 'https://github.com/BookStackApp/BookStack'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/BookStackApp/BookStack/blob/v26.05.3/app/Uploads/ImageService.php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/BookStackApp/BookStack/commit/ac0348a79f3ddd004ca87703948cb9c7d19a420a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4'
    label: disclosure@vulncheck.com
  - url: 'https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bookstack-before-26.05.4-stored-xss-via-drawing-upload
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0047
epssPercentile: 0.37959
ingestedAt: '2026-09-08T21:11:12.289Z'
---

## Overview

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.