Bookstackapp - vulnerabilities (CVEs)

28 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-24.

Products

Bookstack - 28 CVEs
Bookstackappbookstack - 13 CVEs

Newest CVEs of Bookstackapp

CVE-2026-116020 - CVSS 5.4 (medium), 2026-10-24: BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users'…
CVE-2026-89022 - CVSS 9.1 (critical), 2026-09-15: BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in…
CVE-2026-84695 - CVSS 9.3 (critical), 2026-09-02: BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and…
CVE-2026-82450 - CVSS 8.8 (high), 2026-08-29: BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and…
CVE-2026-67204 - CVSS 5.4 (medium), 2026-08-24: BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to…
CVE-2026-5484 - CVSS 6.9 (medium), 2026-04-03: A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php…
CVE-2024-36676 - CVSS 7.5 (high), 2024-07-09: Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public…
CVE-2023-6199 - CVSS 6.5 (medium), 2023-11-20: Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
CVE-2023-4624 - CVSS 2.4 (low), 2023-08-30: Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
CVE-2022-40690 - CVSS 5.4 (medium), 2022-10-24: Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.
CVE-2022-0877 - CVSS 7.6 (high), 2022-03-08: Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
CVE-2021-4194 - CVSS 6.5 (medium), 2022-01-06: bookstack is vulnerable to Improper Access Control
CVE-2021-4119 - CVSS 9.8 (critical), 2021-12-15: bookstack is vulnerable to Improper Access Control
CVE-2021-3944 - CVSS 6.8 (medium), 2021-12-02: bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-4026 - CVSS 6.5 (medium), 2021-11-30: bookstack is vulnerable to Improper Access Control
CVE-2021-3915 - CVSS 7.6 (high), 2021-11-13: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2021-3916 - CVSS 6.5 (medium), 2021-11-05: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-3906 - CVSS 6.5 (medium), 2021-10-27: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2021-3874 - CVSS 6.5 (medium), 2021-10-15: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-3768 - CVSS 5.4 (medium), 2021-09-06: bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3767 - CVSS 5.4 (medium), 2021-09-06: bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3758 - CVSS 6.5 (medium), 2021-09-02: bookstack is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2020-26260 - CVSS 6.4 (medium), 2020-12-09: BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page…
CVE-2020-26211 - CVSS 8.7 (high), 2020-11-03: In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or…
CVE-2020-26210 - CVSS 8.7 (high), 2020-11-03: In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when…
CVE-2020-11055 - CVSS 6.3 (medium), 2020-05-07: In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create…
CVE-2020-5256 - CVSS 8.8 (high), 2020-03-09: BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code…
CVE-2017-1000462 - CVSS 5.4 (medium), 2018-01-03: BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution…