A stored cross-site scripting vulnerability in BookStack allows authenticated editors to execute arbitrary JavaScript in the context of an administrator session, posing a severe risk of account takeover.

The vulnerability exists in the drawing upload endpoint, which fails to perform content inspection or validation on base64 encoded uploads. An attacker with editor permissions can upload a malicious SVG file that, when viewed by an administrator via the image gallery API, executes arbitrary code due to the lack of Content Security Policy headers and input sanitization.

Successful exploitation allows an attacker to compromise the sessions of administrative users, potentially leading to full system takeover and unauthorized access to sensitive institutional data. With a CVSS score of 8.7, this flaw represents a high risk to organizational integrity, as it facilitates lateral movement within the application and potential data exfiltration.

Immediate Action: Upgrade the BookStack instance to version 26.05.4 or later immediately to incorporate the necessary input validation and security patches.

Proactive Monitoring: Review application access logs for unusual SVG upload activity or unexpected requests to the image gallery API that originate from editor-level accounts.

Compensating Controls: Implement strict Content Security Policy (CSP) headers at the web server or proxy level to restrict script execution, and consider limiting file upload types if the business process allows.

Public Exploit Available: No (exploit_available unknown)

The severity of this vulnerability necessitates an immediate update to the latest version of BookStack. Organizations should prioritize patching this issue to prevent the risk of administrative account compromise, as the ability for an editor to trigger malicious code in an administrator's browser poses a significant threat to the security of the entire platform.