CVE-2026-36722: Bookcars v8.3 Authenticated File Upload RCE Vulnerability

Technical summary

CVE-2026-36722 is an authenticated arbitrary file upload vulnerability affecting the /api/create-car-image endpoint in bookcars v8.3. The vulnerability stems from insufficient validation of uploaded files, allowing attackers who have valid authentication credentials to bypass file type restrictions and upload malicious payloads. Successful exploitation can lead to arbitrary code execution on the server. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for prior authentication and the integrity and confidentiality impact, though availability is not directly affected.

Business impact

While this vulnerability requires valid authentication to exploit, it represents a significant insider threat or post-compromise risk. If an attacker gains credentials through phishing, credential stuffing, or social engineering, they can upload malicious files to execute code on your bookcars infrastructure. For car rental or booking platforms, this could lead to data theft (customer information, payment details), service disruption, reputational damage, and potential regulatory compliance violations depending on stored data sensitivity.

Affected systems

Bookcars v8.3 is affected. Organizations running this specific version should prioritize assessment. Verify whether your deployment uses v8.3 and check with the Bookcars project for patch availability and guidance on newer versions.

Exploitability

This vulnerability requires valid authentication, which significantly limits opportunistic exploitation from the internet. However, the attack surface is wider in environments where credentials are shared, weak, or compromised. Given that file uploads are typically user-facing features in booking applications, the attack path is straightforward once authenticated. The vulnerability is not currently tracked in the CISA KEV catalog, indicating limited evidence of active exploitation at the time of publication.

Remediation

Immediately update bookcars to a patched version if available from the project maintainers. If no patch exists, implement strict file upload controls: enforce allowlisting of file types (whitelist only necessary image formats), store uploads outside the web root, disable script execution in upload directories, and validate file content headers independent of file extensions. Consider restricting upload functionality to trusted roles only and implementing virus scanning on all uploaded files.

Patch guidance

Check the Bookcars project repository and official security advisories for patch availability. Update to the latest stable release that addresses CVE-2026-36722. Verify the patch by testing file uploads with intentionally malicious payloads in a controlled environment before deploying to production. Document the patch date and version applied for compliance and audit purposes.

Detection guidance

Monitor API logs for unusual activity on the /api/create-car-image endpoint, particularly POST requests from unexpected user accounts or IP ranges. Look for file uploads with suspicious MIME types, executable extensions (.php, .jsp, .sh, .exe), or polyglot payloads. Enable web application firewall (WAF) rules to block uploads containing script signatures or executable code patterns. Implement integrity monitoring on the application directory to detect unauthorized file creation or modification.

Why prioritize this

Although assigned a MEDIUM severity score, prioritize this vulnerability because it directly enables code execution and affects an active application component. Authentication requirement reduces blast radius but increases insider threat concerns. Organizations with shared credentials, weak access controls, or high-value data in their bookcars deployment should treat this as higher priority. The lack of KEV listing does not diminish the need to patch promptly.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: (1) network-based attack vector with low complexity, (2) requirement for valid authentication (PR:N resolved via user interaction), (3) limited impact to confidentiality and integrity, and (4) no direct availability impact. The score would be significantly higher without the authentication prerequisite. Organizations should supplement this with risk ratings accounting for credential exposure likelihood, data sensitivity, and operational criticality.

Frequently asked questions