BO
Product
bookstack
28
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 7Medium 19Low 1
Watch
Add bookstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-4119 | 9.8 | Dec 15 | bookstack is vulnerable to Improper Access Control Affected: through 21.11.2 |
| CVE-2026-82450 | 8.8 | Aug 29 | BookStack before 26.05.4 Remote Code Execution via Book Cover Affected: before 26.05.4 |
| CVE-2020-5256 | 8.8 | Mar 9 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system… Affected: before 0.25.3 |
| CVE-2026-84695 | 8.7 | Sep 2 | BookStack before 26.05.4 Stored XSS via Drawing Upload Affected: before 26.05.4 |
| CVE-2020-26211 | 8.7 | Nov 3 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would… Affected: before 0.30.4 |
| CVE-2020-26210 | 8.7 | Nov 3 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the… Affected: before 0.30.4 |
| CVE-2024-36676 | 7.5 | Jul 9 | Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms Affected: before v24.05.1 |
| CVE-2026-89022 | 7.4 | Sep 15 | BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion Affected: before 26.05.5 |
| CVE-2021-3944 | 6.8 | Dec 2 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) Affected: before 21.11 |
| CVE-2023-6199 | 6.5 | Nov 20 | Book Stack version 23.10.2 allows filtering local files on the server Affected: 23.10.2 |
| CVE-2021-4194 | 6.5 | Jan 6 | bookstack is vulnerable to Improper Access Control Affected: before 21.12.1 |
| CVE-2021-3916 | 6.5 | Nov 5 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected: before 21.10.3 |
| CVE-2021-3906 | 6.5 | Oct 27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type Affected: before 21.10.1 |
| CVE-2021-3874 | 6.5 | Oct 15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected: before 21.08.5 |
| CVE-2021-3758 | 6.5 | Sep 2 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) Affected: before 21.08 |
| CVE-2020-26260 | 6.4 | Dec 9 | BookStack is a platform for storing and organising information and documentation Affected: before 0.30.5 |
| CVE-2021-3915 | 5.7 | Nov 13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type Affected: before 21.10.3 |
| CVE-2026-116020 New | 5.4 | Oct 24 | BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages Affected: before 26.09.2 |
| CVE-2026-67204 | 5.4 | Aug 24 | BookStack < 26.05.4 Broken Access Control via Image Gallery API Affected: before 26.05.4 |
| CVE-2022-40690 | 5.4 | Oct 24 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script Affected: before 22.09 |
| CVE-2022-0877 | 5.4 | Mar 8 | Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3 Affected: before 22.02.3 |
| CVE-2021-3768 | 5.4 | Sep 6 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 21.08.2 |
| CVE-2021-3767 | 5.4 | Sep 6 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 21.08.2 |
| CVE-2020-11055 | 5.4 | May 7 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation Affected: 0.18.0 before 0.29.2 |
| CVE-2017-1000462 | 5.4 | Jan 3 | BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code Affected: 0.18.4 |
| CVE-2026-5484 | 5.3 | Apr 3 | BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control Affected: 26.03 |
| CVE-2021-4026 | 4.3 | Nov 30 | bookstack is vulnerable to Improper Access Control Affected: before 21.11.2 |
| CVE-2023-4624 | 2.4 | Aug 30 | Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08 Affected: before 23.08 |
Showing 28