BookStack versions before 26.05.4 are affected by a remote code execution vulnerability in the portable ZIP import functionality. Authenticated users with Import Content and Create Books permissions can exploit this by uploading a PHP polyglot file disguised as a book cover image. The attack bypasses image extension validation by embedding a PHP file with a .php filename inside the ZIP archive. Once uploaded, the malicious file is stored in the public web root and can be executed by unauthenticated HTTP requests. This effectively allows privilege escalation from a limited authenticated user to full server-side code execution. The vulnerability has been patched in BookStack version 26.05.4. References include the official BookStack GitHub repository and a specific commit addressing the flaw.