CVE-2026-82450 - BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. - 漏洞详情

漏洞编号：CVE-2026-82450

风险等级：高危

漏洞来源：CVE

CVE 编号：CVE-2026-82450

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-434

发布/更新时间：2026-08-29 / 2026-08-29

漏洞描述

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

漏洞描述

相关链接

相关漏洞