Read the docs
TI-2020-16032 Aliases CVE-2020-26211GHSA-ch37-ch8w-cfrq

Cross-Site Scripting in BookStack

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.

Why it matters now

EPSS 0.01096 65th percentileScored 2026-11-07
Fix Fixed BookStack (BookStackApp): 0.30.4ssddanbrown/bookstack (Packagist): 0.30.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
bookstackappBookStackbefore 0.30.40.30.4Patch availableCNA
—ssddanbrown/bookstack (Packagist)before 0.30.40.30.4Patch availableGHSA-ch37-ch8w-cfrq
  • BookStack Vendorbookstackapp Affected before 0.30.4 Fixed in 0.30.4 Patch available CNA
  • ssddanbrown/bookstack (Packagist) Vendor— Affected before 0.30.4 Fixed in 0.30.4 Patch available GHSA-ch37-ch8w-cfrq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*before 0.30.4Vulnerablebookstackapp
  • cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:* Versions before 0.30.4 Vulnerable ·bookstackapp

Remediation

  • Fix · CNA BookStack (BookStackApp) Fixed in 0.30.4
  • Fix · GHSA-ch37-ch8w-cfrq ssddanbrown/bookstack (Packagist) Fixed in 0.30.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26211
  2. 2026-10-03 Alias added: GHSA-ch37-ch8w-cfrq

References

Patch 2

Advisory 3

Other 2

  • TI-2021-02995 Improper Access Control in bookstackapp/bookstack CVSS 3.1CRITICAL 9.8
  • TI-2023-04263 Server-Side Request Forgery (SSRF) in bookstackapp/bookstack CVSS 3.1LOW 2.4
  • TI-2020-04312 Remote Code Execution Through Image Uploads in BookStack CVSS 3.1HIGH 8.8
  • TI-2020-16031 Cross-Site Scripting in BookStack CVSS 3.1HIGH 8.7
  • TI-2023-05693 Book Stack v23.10.2 - LFR via Blind SSRF CVSS 3.1MEDIUM 6.5
  • TI-2021-02848 Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack CVSS 3.1MEDIUM 6.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences