High severity · published Nov 3, 2020
CVE-2020-26210
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the…
8.7
CVSS
1.2%
EPSS
No
On KEV
Description
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bookstack · Bookstackapp
before 0.30.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26210
Exploit
https://bookstackapp.com/blog/beta-release-v0-30-4/
Patch
https://github.com/BookStackApp/BookStack/commit/349162ea139556b2d25e09e155cec84e21cc9227
Third Party Advisory
https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4
Exploit
https://github.com/BookStackApp/BookStack/security/advisories/GHSA-7p2j-4h6p-cq3h
More from Bookstack
9.8
CVE-2021-4119
bookstack is vulnerable to Improper Access Control
8.8
CVE-2026-82450
BookStack before 26.05.4 Remote Code Execution via Book Cover
8.8
CVE-2020-5256
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system…
8.7
CVE-2026-84695
BookStack before 26.05.4 Stored XSS via Drawing Upload
8.7
CVE-2020-26211
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would…