Product
BookStack before version 26.05.4 is vulnerable to remote code execution due to improper validation of files within the portable ZIP import functionality.