Priority LOW 23
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00181 · Published 2026-10-24 · Fixed in 26.09.2 CWE-863
Priority MEDIUM 42
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social…
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00465 · Published 2026-09-15 · Fixed in 26.05.5 CWE-290
Priority MEDIUM 40
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection.
CVSS 4.0CRITICAL 9.3· Network · Low privileges · User interaction · EPSS 0.0047 · Published 2026-09-02 · Fixed in 26.05.4 CWE-79
Priority MEDIUM 42
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00999 · Published 2026-08-29 · Fixed in 26.05.4 CWE-434
Priority LOW 24
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-t…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00413 · Published 2026-08-24 · Fixed in 26.05.4 CWE-863
Priority HIGH 70
A weakness has been identified in BookStackApp BookStack up to 26.03.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00334 · Published 2026-04-03 · Fixed in 26.03.1 CWE-266
Priority LOW 32
Book Stack version 23.10.2 allows filtering local files on the server.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01381 · Published 2023-11-20 · No fix listed CWE-918
Priority MEDIUM 46
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
CVSS 3.1LOW 2.4· Network · High privileges · User interaction · EPSS 0.00625 · Published 2023-08-30 · Fixed in v23.08 CWE-918
Priority LOW 26
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00892 · Published 2022-10-24 · Fixed in v22.09 CWE-79
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00782 · Published 2022-03-08 · Fixed in v22.02.3, 22.02.3 CWE-79
Priority LOW 30
bookstack is vulnerable to Improper Access Control
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00731 · Published 2022-01-06 · Fixed in 21.12.1 CWE-284
Priority MEDIUM 64
bookstack is vulnerable to Improper Access Control
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.26893 · Published 2021-12-15 · Fixed in 21.11.3 CWE-284
Priority LOW 31
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00641 · Published 2021-12-02 · Fixed in 21.11 CWE-352
Priority LOW 22
bookstack is vulnerable to Improper Access Control
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00926 · Published 2021-11-30 · Fixed in 21.11.2 CWE-284
Priority LOW 28
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00961 · Published 2021-11-13 · Fixed in 21.10.3, 21.0.3 CWE-434
Priority LOW 31
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01241 · Published 2021-11-05 · Fixed in 21.10.3 CWE-22
Priority LOW 30
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00668 · Published 2021-10-27 · Fixed in 21.10.1 CWE-434
Priority LOW 31
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01202 · Published 2021-10-15 · Fixed in 21.08.5 CWE-22
Priority LOW 25
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0058 · Published 2021-09-06 · Fixed in 21.08.2 CWE-79
Priority LOW 25
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0058 · Published 2021-09-06 · Fixed in 21.08.2 CWE-79
Priority LOW 30
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.008 · Published 2021-09-02 · Fixed in 21.08 CWE-918
Priority LOW 30
BookStack is a platform for storing and organising information and documentation.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00837 · Published 2020-12-09 · Fixed in v0.30.5 CWE-74
Priority MEDIUM 40
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page,…
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.01096 · Published 2020-11-03 · Fixed in 0.30.4 CWE-79
Priority MEDIUM 40
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.01169 · Published 2020-11-03 · Fixed in 0.30.4 CWE-79
Priority LOW 29
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00782 · Published 2020-05-07 · Fixed in 0.29.2 CWE-79
Load more
THREATIST.IORead the docs