Bookstackapp Bookstack
22 CVEs affecting Bookstackapp Bookstack. Latest disclosed: 2026-04-03. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4119 | Critical | 9.8 | 2021-12-15 | bookstack is vulnerable to Improper Access Control |
CVE-2020-5256 | High | 7.9 | 2020-03-09 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code… |
CVE-2020-26211 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or… |
CVE-2020-26210 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicke… |
CVE-2021-3944 | Medium | 6.8 | 2021-12-02 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2023-6199 | Medium | 6.5 | 2023-11-20 | Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF. |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-3916 | Medium | 6.5 | 2021-11-05 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3906 | Medium | 6.5 | 2021-10-27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-3874 | Medium | 6.5 | 2021-10-15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3758 | Medium | 6.5 | 2021-09-02 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2020-26260 | Medium | 6.4 | 2020-12-09 | BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page co… |
CVE-2020-11055 | Medium | 6.3 | 2020-05-07 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments… |
CVE-2021-3915 | Medium | 5.7 | 2021-11-13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2022-40690 | Medium | 5.4 | 2022-10-24 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. |
CVE-2022-0877 | Medium | 5.4 | 2022-03-08 | Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. |
CVE-2021-3768 | Medium | 5.4 | 2021-09-06 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3767 | Medium | 5.4 | 2021-09-06 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2017-1000462 | Medium | 5.4 | 2018-01-03 | BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution o… |
CVE-2026-5484 | Medium | 5.3 | 2026-04-03 | A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of… |