Image Uploads: Validate the target reference page #6126

New issue

Closed

opened 2026-05-10 16:46:14 +02:00 by danb · 0 comments

danb commented

2026-05-10 16:46:14 +02:00

Owner

Description

Validate the uploaded_to value for image uploads.
Should also validate user access for that reference page.

Need to check aligned with other image upload endpoints (drawio, API etc...).

Originally raised by Pablo Ruiz as a security report.
Not considering it to be a security issue at this time since image upload permissions are still required, and I don't think the lack of validation here allows wider scope of risk (beyond maybe a little extra confusion).

### Description Validate the uploaded_to value for image uploads. Should also validate user access for that reference page. Need to check aligned with other image upload endpoints (drawio, API etc...). Originally raised by Pablo Ruiz as a security report. Not considering it to be a security issue at this time since image upload permissions are still required, and I don't think the lack of validation here allows wider scope of risk (beyond maybe a little extra confusion).

👍 1

danb added this to the BookStack v26.05 milestone

2026-05-10 16:46:14 +02:00

danb added the

Focus: Back-End

Type

Maintenance

labels

2026-05-10 16:46:17 +02:00

danb referenced this issue from a commit

2026-05-14 19:13:29 +02:00

Images: Increased validation against related page on upload