Login Request a demo
BO
Product
bookstack
by bookstackapp · last CVE Oct 24, 2026
28
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities28In the news0Timeline
Severity mix
Critical 1High 7Medium 19Low 1
Severity
All severities28Critical1High7Medium19Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add bookstack to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-82450
8.8
1%
Aug 29
BookStack before 26.05.4 Remote Code Execution via Book Cover
Affected: before 26.05.4
CVE-2020-5256
8.8
2%
Mar 9
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system…
Affected: before 0.25.3
CVE-2026-84695
8.7
0%
Sep 2
BookStack before 26.05.4 Stored XSS via Drawing Upload
Affected: before 26.05.4
CVE-2020-26211
8.7
1%
Nov 3
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would…
Affected: before 0.30.4
CVE-2020-26210
8.7
1%
Nov 3
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the…
Affected: before 0.30.4
CVE-2024-36676
7.5
1%
Jul 9
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms
Affected: before v24.05.1
CVE-2026-89022
7.4
0%
Sep 15
BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
Affected: before 26.05.5
Showing 7