CVE-2026-36722 Details

A vulnerability allowing authenticated users to upload arbitrary files has been identified in BookCars version 8.3 and prior. This issue resides in the '/api/create-car-image' component, where uploaded files are stored in a temporary CDN directory without adequate validation of file types or content. The application only creates a safe filename but neglects to check file extensions or verify the actual content of the uploaded files. Consequently, attackers can upload files with potentially harmful extensions, such as HTML, containing malicious JavaScript. This JavaScript is executed when the file is accessed through the CDN directory, resulting in a stored Cross-Site Scripting (XSS) attack.

Users are advised to update to a version of BookCars later than 8.3. Additionally, implement a strict whitelist of allowed file extensions, validate file content using magic bytes verification, enforce proper Content-Type and Content-Disposition headers when serving uploaded files, apply Content Security Policy (CSP) policies to CDN directories, and sanitize or reject files that may contain executable code.