Read the docs

bookstackapp

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

bookstackapp records in CISA KEV

No bookstackapp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Bookstack 21 records MEDIUM

Records

27 records

TI-2026-60332 CVE-2026-89022 · GHSA-54r8-f2jx-5qj6

BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

Priority MEDIUM 42

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00465 Published 2026-09-15 Fixed in 26.05.5 CWE-290
TI-2026-56847 CVE-2026-82450 · GHSA-jgmr-x24h-q8jj

BookStack before 26.05.4 Remote Code Execution via Book Cover

Priority MEDIUM 42

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00999 Published 2026-08-29 Fixed in 26.05.4 CWE-434
TI-2020-04312 CVE-2020-5256 · GHSA-g9rq-x4fj-f5hx

Remote Code Execution Through Image Uploads in BookStack

Priority MEDIUM 42

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01969 Published 2020-03-09 Fixed in 0.25.5 CWE-95
TI-2026-58223 CVE-2026-84695 · GHSA-r46q-wv4x-rj72

BookStack before 26.05.4 Stored XSS via Drawing Upload

Priority MEDIUM 40

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0047 Published 2026-09-02 Fixed in 26.05.4 CWE-79
TI-2020-16032 CVE-2020-26211 · GHSA-ch37-ch8w-cfrq

Cross-Site Scripting in BookStack

Priority MEDIUM 40

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page,…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01096 Published 2020-11-03 Fixed in 0.30.4 CWE-79
TI-2020-16031 CVE-2020-26210 · GHSA-vmfp-7cw6-345x

Cross-Site Scripting in BookStack

Priority MEDIUM 40

In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01169 Published 2020-11-03 Fixed in 0.30.4 CWE-79
TI-2023-05693 CVE-2023-6199 · GHSA-fwg4-q55q-w62p

Book Stack v23.10.2 - LFR via Blind SSRF

Priority LOW 32

Book Stack version 23.10.2 allows filtering local files on the server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01381 Published 2023-11-20 No fix listed CWE-918
TI-2021-02825 CVE-2021-3916 · GHSA-g66g-3vwf-hfgf

Path Traversal in bookstackapp/bookstack

Priority LOW 31

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01241 Published 2021-11-05 Fixed in 21.10.3 CWE-22
TI-2021-02799 CVE-2021-3874 · GHSA-wwh8-rr74-53qm

Path Traversal in bookstackapp/bookstack

Priority LOW 31

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01202 Published 2021-10-15 Fixed in 21.08.5 CWE-22
TI-2020-16081 CVE-2020-26260

Server Side Request Forgery in BookStack

Priority LOW 30

BookStack is a platform for storing and organising information and documentation.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00837 Published 2020-12-09 Fixed in v0.30.5 CWE-74
TI-2020-08929 CVE-2020-11055 · GHSA-5vf7-q87h-pg6w

Cross-site Scripting in BookStack

Priority LOW 29

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00782 Published 2020-05-07 Fixed in 0.29.2 CWE-79
TI-2022-19325 CVE-2022-40690 · GHSA-fxr6-45h7-wgcx

Cross-site scripting in BookStack

Priority LOW 26

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00892 Published 2022-10-24 Fixed in v22.09 CWE-79
TI-2026-47524 CVE-2026-67204 · GHSA-v32j-vgqh-f22g

BookStack < 26.05.4 Broken Access Control via Image Gallery API

Priority LOW 24

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-t…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00413 Published 2026-08-24 Fixed in 26.05.4 CWE-863
Load more
Open these records in search →