BookStack versions prior to 26.05.4 are vulnerable to remote code execution, which allows authenticated users to achieve full system compromise by bypassing file extension validation.

This is an unrestricted file upload vulnerability (CWE-434) located within the portable ZIP import functionality. While the attack requires an authenticated user with specific permissions (Import Content and Create Books), the resulting malicious file is stored in the public web root and can be executed by any unauthenticated request.

Successful exploitation of this vulnerability results in full remote code execution on the underlying server. This grants an attacker the ability to execute arbitrary commands, potentially leading to unauthorized data access, system-wide compromise, and lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-severity risk to the confidentiality, integrity, and availability of the host environment.

Immediate Action: Upgrade BookStack to version 26.05.4 or later immediately to incorporate the necessary file validation patches.

Proactive Monitoring: Review web server access logs for suspicious requests targeting files with .php extensions located within user upload or storage directories.

Compensating Controls: Implement strict file upload policies at the Web Application Firewall (WAF) level to prevent the upload of executable scripts, and ensure that the web server configuration forbids the execution of scripts within user-writable directories.

Public Exploit Available: Unknown.

Given the potential for remote code execution, this vulnerability poses a significant threat to the security of the BookStack application. Administrators should prioritize patching to version 26.05.4 across all instances. If an immediate update is not feasible, restrict access to the import functionality to trusted users only and apply strict file type filtering at the perimeter to mitigate the risk of exploitation.