CVE-2026-84695

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-84695

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84695.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-84695

Published

2026-09-02T00:37:51Z

Modified

2026-09-10T03:31:03Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

BookStack before 26.05.4 Stored XSS via Drawing Upload

Details

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84695.json"
}

References

Affected packages

Git / github.com/bookstackapp/bookstack

Affected ranges

Type

GIT

Repo

https://github.com/bookstackapp/bookstack

Events

Introduced

Fixed

cec78b1bcf096a74bf0a79fae3f884dc1d0803e4

Fixed

ac0348a79f3ddd004ca87703948cb9c7d19a420a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.05.4"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.7.2

v.*

v.0.7.1

v0.*

v0.10.0

v0.11.0

v0.11.1

v0.11.2

v0.12.0

v0.12.1

v0.12.2

v0.13.0

v0.13.1

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.17.4

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.19.0

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.21.0

v0.22.0

v0.23.0

v0.23.1

v0.23.2

v0.24.0

v0.24.1

v0.24.2

v0.24.3

v0.25.0

v0.25.1

v0.25.2

v0.25.3

v0.25.4

v0.25.5

v0.26.0

v0.26.1

v0.26.2

v0.26.3

v0.26.4

v0.27

v0.27.1

v0.27.2

v0.27.3

v0.27.4

v0.27.5

v0.28.0

v0.28.1

v0.28.2

v0.28.3

v0.29.0

v0.29.1

v0.29.2

v0.29.3

v0.30.0

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.30.5

v0.30.6

v0.30.7

v0.31.0

v0.31.1

v0.31.2

v0.31.3

v0.31.4

v0.31.5

v0.31.6

v0.31.7

v0.31.8

v0.5.0

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.7.0

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.8.0

v0.8.1

v0.8.2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v21.*

v21.04

v21.04.1

v21.04.2

v21.04.3

v21.04.4

v21.04.5

v21.04.6

v21.05

v21.05.1

v21.05.2

v21.05.3

v21.05.4

v21.08

v21.08.1

v21.08.2

v21.08.3

v21.08.4

v21.08.5

v21.08.6

v21.10

v21.10.1

v21.10.2

v21.10.3

v21.11

v21.11.1

v21.11.2

v21.11.3

v21.12

v21.12.1

v21.12.2

v21.12.3

v21.12.4

v21.12.5

v22.*

v22.02

v22.02.1

v22.02.2

v22.02.3

v22.03

v22.03.1

v22.04

v22.04.1

v22.04.2

v22.06

v22.06.1

v22.06.2

v22.07

v22.07.1

v22.07.2

v22.07.3

v22.09

v22.09.1

v22.10

v22.10.1

v22.10.2

v22.11

v22.11.1

v23.*

v23.01

v23.01.1

v23.02

v23.02.1

v23.02.2

v23.02.3

v23.05

v23.05.1

v23.05.2

v23.06

v23.06.1

v23.06.2

v23.08

v23.08.1

v23.08.2

v23.08.3

v23.10

v23.10.1

v23.10.2

v23.10.3

v23.10.4

v23.12

v23.12.1

v23.12.2

v23.12.3

v24.*

v24.02

v24.02.1

v24.02.2

v24.02.3

v24.05

v24.05.1

v24.05.2

v24.05.3

v24.05.4

v24.10

v24.10.1

v24.10.2

v24.10.3

v24.11.4

v24.12

v24.12.1

v25.*

v25.02

v25.02.1

v25.02.2

v25.02.3

v25.02.4

v25.02.5

v25.05

v25.05.1

v25.05.2

v25.07

v25.07.1

v25.07.2

v25.07.3

v25.11

v25.11.1

v25.11.2

v25.11.3

v25.11.4

v25.11.5

v25.11.6

v25.12

v25.12.1

v25.12.2

v25.12.3

v25.12.4

v25.12.5

v25.12.6

v25.12.7

v25.12.8

v25.12.9

v26.*

v26.03

v26.03.1

v26.03.2

v26.03.3

v26.03.4

v26.03.5

v26.05

v26.05.1

v26.05.2

v26.05.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84695.json"