BookStack CVE-2026-82450

Exploitation requires an authenticated BookStack account explicitly granted both the 'Import Content' permission and the 'Create Books' permission - these are non-default assignments that an administrator must deliberately configure for a role. The attack surface is the ZIP-based portable content import feature, which must be reachable by the attacker's account. No special server configuration, non-standard deployment mode, or additional network service is required beyond a standard BookStack installation running on a PHP-capable web server with a publicly accessible upload directory. Once the malicious ZIP is successfully imported, the resulting webshell is reachable and executable by any unauthenticated HTTP client with network access to the server, removing the authentication barrier for the execution step of the attack.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the core risk profile: the attack path is low-complexity, requires no special server configuration, and yields full server-side code execution. The primary limiting factor is the PR:L requirement - the attacker must hold both 'Import Content' and 'Create Books' role permissions, which must be explicitly granted by an administrator and are not assigned to the default guest or viewer roles. No CISA KEV listing is present and no EPSS score was provided, so exploitation probability cannot be quantified from this data; however, the attack mechanism is mechanical (craft a ZIP, submit it, fetch the URL) and does not require heap manipulation, timing, or cryptographic bypass, making it highly reliable once the permission prerequisite is satisfied. Any deployment where non-administrator users hold content import rights should treat this as urgent regardless of instance size. No conflicting signals exist between the CVSS vector and the description; the network vector and low-privilege requirement are fully consistent with the import UI attack surface.

An attacker with a low-privileged BookStack account granted both Import Content and Create Books permissions crafts a ZIP archive whose manifest references a PHP webshell file with a .php extension as the book cover. Submitting this ZIP through the BookStack import interface causes the server to extract and store the PHP file in the public image upload directory. The attacker then issues an unauthenticated HTTP GET request to the resulting cover URL, triggering PHP execution and achieving arbitrary remote code execution under the web server process identity.