Bookstackapp Bookstack
26 CVEs affecting Bookstackapp Bookstack. Latest disclosed: 2026-09-15. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4119 | Critical | 9.8 | 2021-12-15 | bookstack is vulnerable to Improper Access Control |
CVE-2026-82450 | High | 8.8 | 2026-08-29 | BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Crea… |
CVE-2026-84695 | High | 8.7 | 2026-09-02 | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores… |
CVE-2020-5256 | High | 7.9 | 2020-03-09 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code… |
CVE-2020-26211 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or… |
CVE-2020-26210 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicke… |
CVE-2026-89022 | High | 7.4 | 2026-09-15 | BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as… |
CVE-2021-3944 | Medium | 6.8 | 2021-12-02 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2023-6199 | Medium | 6.5 | 2023-11-20 | Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF. |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-3916 | Medium | 6.5 | 2021-11-05 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3906 | Medium | 6.5 | 2021-10-27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-3874 | Medium | 6.5 | 2021-10-15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3758 | Medium | 6.5 | 2021-09-02 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2020-26260 | Medium | 6.4 | 2020-12-09 | BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page co… |
CVE-2020-11055 | Medium | 6.3 | 2020-05-07 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments… |
CVE-2021-3915 | Medium | 5.7 | 2021-11-13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2026-67204 | Medium | 5.4 | 2026-08-24 | BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to ma… |
CVE-2022-40690 | Medium | 5.4 | 2022-10-24 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. |
CVE-2022-0877 | Medium | 5.4 | 2022-03-08 | Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. |