Login Request a demo
BO
Product
bookstack
by bookstackapp · last CVE Oct 24, 2026
28
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities28In the news0Timeline
Severity mix
Critical 1High 7Medium 19Low 1
Severity
All severities28Critical1High7Medium19Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add bookstack to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-3944
6.8
1%
Dec 2
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Affected: before 21.11
CVE-2023-6199
6.5
1%
Nov 20
Book Stack version 23.10.2 allows filtering local files on the server
Affected: 23.10.2
CVE-2021-4194
6.5
1%
Jan 6
bookstack is vulnerable to Improper Access Control
Affected: before 21.12.1
CVE-2021-3916
6.5
1%
Nov 5
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected: before 21.10.3
CVE-2021-3906
6.5
1%
Oct 27
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Affected: before 21.10.1
CVE-2021-3874
6.5
1%
Oct 15
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected: before 21.08.5
CVE-2021-3758
6.5
1%
Sep 2
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
Affected: before 21.08
CVE-2020-26260
6.4
1%
Dec 9
BookStack is a platform for storing and organising information and documentation
Affected: before 0.30.5
CVE-2021-3915
5.7
1%
Nov 13
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Affected: before 21.10.3
CVE-2026-116020
New
5.4
0%
Oct 24
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
Affected: before 26.09.2
CVE-2026-67204
5.4
0%
Aug 24
BookStack < 26.05.4 Broken Access Control via Image Gallery API
Affected: before 26.05.4
CVE-2022-40690
5.4
1%
Oct 24
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script
Affected: before 22.09
CVE-2022-0877
5.4
1%
Mar 8
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3
Affected: before 22.02.3
CVE-2021-3768
5.4
1%
Sep 6
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected: before 21.08.2
CVE-2021-3767
5.4
1%
Sep 6
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected: before 21.08.2
CVE-2020-11055
5.4
1%
May 7
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation
Affected: 0.18.0 before 0.29.2
CVE-2017-1000462
5.4
1%
Jan 3
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code
Affected: 0.18.4
CVE-2026-5484
5.3
0%
Apr 3
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
Affected: 26.03
CVE-2021-4026
4.3
1%
Nov 30
bookstack is vulnerable to Improper Access Control
Affected: before 21.11.2
Showing 19