CVE-2026-84695

HighCVSS 8.7/10Last modified Sep 8, 2026

Description

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-846968.2Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent CVE-2026-846975.3Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPCVE-2026-846986.5PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplieCVE-2026-846999.1Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. UnauthenticatCVE-2026-84709.1IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic rCVE-2026-847008.6PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when theCVE-2026-847015.4NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with CVE-2026-847027.5facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directoCVE-2026-847067.6A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates CVE-2026-847125.3A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ CVE-2026-847147.1A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular