BookStack ZIP Import Remote Code Execution (CVE-2026-82450): Scope and Response

BookStack is a self-hosted documentation platform organized around books, chapters, and pages. CVE-2026-82450 affects the portable ZIP import flow before version 26.05.4. According to the public advisory, a user with both Import Content and Create Books permissions can place a PHP polyglot file with a .php filename in the archive as a book cover. The vulnerable validation can allow that file to be stored in the public web root, where an unauthenticated web request may cause the PHP handler to execute it.

The requirement for an authenticated import user does not make the issue routine. Content-management permissions can cross into the web-server process when an imported file lands in an executable public path. GitHub's advisory rates the issue High at CVSS 4.0 8.7. Scope the response around the running BookStack version, holders of the two permissions, portable ZIP import records, the public upload path, and the web server's PHP handling rules.

Attack Conditions and Storage Path

The first condition is a BookStack release before 26.05.4. The second is an account with Import Content and Create Books. During a portable ZIP import, the affected flow can accept a cover file that combines a .php name with image-like content and store it under a directly reachable upload path. If the web server permits PHP execution there, requesting the file crosses from application-level import permissions into server-side code execution. Review role assignments, temporary administrators, storage mounts, the relationship between public and document roots, and script handling on upload directories.

Impact and Trust Boundaries

Code executed as the web-server process may reach BookStack files, environment configuration, database credentials, uploaded documents, and network resources available to that identity. Container isolation, filesystem permissions, SELinux or AppArmor, PHP-FPM identity, secret injection, and egress controls determine the practical boundary. BookStack's official 26.05.4 security release fixes the missing book-cover validation in ZIP imports and adds MIME-based content-type checking to image serving. Apply the full release through the official update process rather than replacing isolated files.

Upgrade and Temporary Controls

Upgrade every BookStack instance to 26.05.4 or later. Record the current version, container digest, PHP and web-server configuration, and storage mounts, and back up the database and uploads before the change. While the upgrade is prepared, restrict Import Content and Create Books to the smallest trusted administrator group and disable script execution in upload directories where the deployment supports that control. These measures reduce exposure but do not replace the application fix.

Upload Path Inspection

BookStack advises environments with untrusted users—especially edit-level users—to inspect image upload folders for unexpected non-image content. On a typical Linux installation, the official post identifies public/uploads and storage/uploads/images. Adapt the check to the real installation and storage driver, collect filenames, sizes, modification times, MIME types, owners, and hashes without deleting or executing files, then correlate those records with portable ZIP imports, application logs, web access, and PHP handling.

Administrator Checklist

1. Confirm whether any running BookStack instance is earlier than 26.05.4.
2. Identify every role and user holding both Import Content and Create Books permissions.
3. Upgrade through the official procedure and confirm every replica and container runs 26.05.4 or later.
4. Collect a read-only inventory of public/uploads and storage/uploads/images, including MIME type, time, owner, and hash.
5. Correlate ZIP imports, application logs, web access, and PHP processing across the same time window.

Do not open a suspicious file in a browser or test whether it executes. Preserve the file and metadata, isolate the affected service through the incident-response process, and plan credential rotation only after the patched and contained environment is ready to receive new secrets. Post-upgrade validation should confirm that authorized portable ZIP imports, book creation, cover display, and page navigation work; unprivileged accounts cannot import; covers are served with allowed image types; and PHP cannot execute from public upload directories.

Operational Follow-Through

Treat content import as a high-risk administrative function. Separate Import Content and Create Books from ordinary editing roles, log the operator, source archive, time, and destination book for bulk imports, and monitor mismatches among extensions, MIME types, and executable handlers in the public web root. This turns the one-time response into a repeatable sequence: version correction, permission reduction, storage-path inspection, and functional validation.