BookStack versions prior to 26.05.4 are vulnerable to remote code execution through the portable ZIP import feature. An attacker can upload a PHP file disguised as a book cover by embedding it in a ZIP archive. The import process accepts the file, stores it in the public web root, and the PHP code is executed by any unauthenticated request to that location. This flaw allows an attacker to run arbitrary PHP code on the host where BookStack is deployed, compromising confidentiality, integrity, and availability of the application and underlying server.

The vulnerability affects the BookStack application (bookstackapp:bookstack) in all releases before 26.05.4. Systems using older BookStack editions should review their installed version and apply updates accordingly.

The CVSS score of 8.7 indicates high severity, and while an EPSS score is not available, the lack of a KEV listing does not diminish the risk of exploitation. Attackers only need Import Content and Create Books permissions to construct the malicious ZIP, and the code is triggered by unauthenticated access to the uploaded cover, making the exploit straightforward once the malicious file is in place. The vulnerability offers a clear attack path with minimal prerequisites, resulting in a high likelihood of exploitation.