BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

BookStack versions before 26.05.4 contain a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint. The endpoint accepts unvalidated base64 content and stores it without content inspection, allowing SVG files with embedded scripts to be uploaded. Attackers with editor-level permissions can exploit this by uploading malicious SVG files that execute scripts in administrator browsers when accessed via the image gallery API. The vulnerability is compounded by the absence of content-type validation and CSP headers. The issue has been patched in BookStack version 26.05.4. A fix was committed to the repository and a release was tagged accordingly. Organizations using affected versions should upgrade immediately to mitigate risk of privilege escalation or session hijacking via stored XSS.