Remote Code Execution in BookStack via ZIP Import

BookStack versions prior to 26.05.4 are susceptible to a remote code execution vulnerability located in the portable ZIP import feature. The flaw arises from insufficient validation of file extensions within ZIP archives. An authenticated user possessing 'Import Content' and 'Create Books' permissions can upload a ZIP archive containing a PHP polyglot file disguised as a book cover image. The application extracts the malicious file and stores it within the public web root directory. Because the system does not properly sanitize or verify the contents of the ZIP, the attacker can subsequently trigger the execution of the stored PHP script by making a direct, unauthenticated HTTP request to the location of the uploaded file. This vulnerability poses a significant risk as it allows for arbitrary code execution on the underlying server.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to achieve arbitrary remote code execution on the server hosting the BookStack application. This can lead to full system compromise, data exfiltration, or the deployment of persistent backdoors within the organization's infrastructure.

Recommendation

• Upgrade the BookStack instance to version 26.05.4 or later immediately.
• Review the permissions of accounts with 'Import Content' and 'Create Books' access to ensure the principle of least privilege is maintained.
• Audit the web root directory for unauthorized .php files that do not correspond to the legitimate application structure.