Remote Code Execution Through Image Uploads in BookStack
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-95.
Summary
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bookstackapp | BookStack | before 0.25.5 | 0.25.5 | Patch available | CNA |
| — | ssddanbrown/bookstack (Packagist) | before 0.25.5 | 0.25.5 | Patch available | GHSA-g9rq-x4fj-f5hx |
- BookStack Vendorbookstackapp Affected before 0.25.5 Fixed in 0.25.5 Patch available CNA
- ssddanbrown/bookstack (Packagist) Vendor— Affected before 0.25.5 Fixed in 0.25.5 Patch available GHSA-g9rq-x4fj-f5hx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:* | before 0.25.3 | Vulnerable | bookstackapp |
- cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:* Versions before 0.25.3 Vulnerable ·bookstackapp
Remediation
- Fix · CNA BookStack (BookStackApp) Fixed in 0.25.5
- Fix · GHSA-g9rq-x4fj-f5hx ssddanbrown/bookstack (Packagist) Fixed in 0.25.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5256
- 2026-10-03 Alias added: GHSA-g9rq-x4fj-f5hx
References
Advisory 2
More bookstackapp Bookstack vulnerabilities
- TI-2021-02995 Improper Access Control in bookstackapp/bookstack CVSS 3.1CRITICAL 9.8
- TI-2023-04263 Server-Side Request Forgery (SSRF) in bookstackapp/bookstack CVSS 3.1LOW 2.4
- TI-2020-16032 Cross-Site Scripting in BookStack CVSS 3.1HIGH 8.7
- TI-2020-16031 Cross-Site Scripting in BookStack CVSS 3.1HIGH 8.7
- TI-2023-05693 Book Stack v23.10.2 - LFR via Blind SSRF CVSS 3.1MEDIUM 6.5
- TI-2021-02848 Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack CVSS 3.1MEDIUM 6.8
Sources
- CVE-2020-5256 · CVE Program
- CVE-2020-5256 · NVD
- FIRST EPSS
- GHSA-g9rq-x4fj-f5hx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences