Read the docs

bookstackapp

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

bookstackapp records in CISA KEV

No bookstackapp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Bookstack 21 records MEDIUM

Records

21 records in Bookstack · all components

TI-2020-04312 CVE-2020-5256 · GHSA-g9rq-x4fj-f5hx

Remote Code Execution Through Image Uploads in BookStack

Priority MEDIUM 42

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01969 Published 2020-03-09 Fixed in 0.25.5 CWE-95
TI-2020-16032 CVE-2020-26211 · GHSA-ch37-ch8w-cfrq

Cross-Site Scripting in BookStack

Priority MEDIUM 40

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page,…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01096 Published 2020-11-03 Fixed in 0.30.4 CWE-79
TI-2020-16031 CVE-2020-26210 · GHSA-vmfp-7cw6-345x

Cross-Site Scripting in BookStack

Priority MEDIUM 40

In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01169 Published 2020-11-03 Fixed in 0.30.4 CWE-79
TI-2023-05693 CVE-2023-6199 · GHSA-fwg4-q55q-w62p

Book Stack v23.10.2 - LFR via Blind SSRF

Priority LOW 32

Book Stack version 23.10.2 allows filtering local files on the server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01381 Published 2023-11-20 No fix listed CWE-918
TI-2021-02825 CVE-2021-3916 · GHSA-g66g-3vwf-hfgf

Path Traversal in bookstackapp/bookstack

Priority LOW 31

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01241 Published 2021-11-05 Fixed in 21.10.3 CWE-22
TI-2021-02799 CVE-2021-3874 · GHSA-wwh8-rr74-53qm

Path Traversal in bookstackapp/bookstack

Priority LOW 31

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01202 Published 2021-10-15 Fixed in 21.08.5 CWE-22
TI-2020-16081 CVE-2020-26260

Server Side Request Forgery in BookStack

Priority LOW 30

BookStack is a platform for storing and organising information and documentation.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00837 Published 2020-12-09 Fixed in v0.30.5 CWE-74
TI-2020-08929 CVE-2020-11055 · GHSA-5vf7-q87h-pg6w

Cross-site Scripting in BookStack

Priority LOW 29

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00782 Published 2020-05-07 Fixed in 0.29.2 CWE-79
TI-2022-19325 CVE-2022-40690 · GHSA-fxr6-45h7-wgcx

Cross-site scripting in BookStack

Priority LOW 26

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00892 Published 2022-10-24 Fixed in v22.09 CWE-79
Open these records in search →