Vendor
BookStackApp
24 known vulnerabilities.
BookStackApp at a glance
- Last 12 months
- 6
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 2 | 0 |
| Aug 2026 | 2 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
24 results · Feed
-
Medium 5.4
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment I…
-
High 7.4
BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id na…
-
High 8.7
BookStack before 26.05.4 Stored XSS via Drawing Upload
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing sc…
-
High 8.8
BookStack before 26.05.4 Remote Code Execution via Book Cover
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image exten…
-
Medium 5.4
BookStack < 26.05.4 Broken Access Control via Image Gallery API
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery A…
-
Medium 5.3
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to im…
-
Low 2.4
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
-
High 7.6
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
-
Medium 4.3
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 5.3CVE-2021-4119 EPSS 27%
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Low 3.1
Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
High 7.6
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Medium 6.5
Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 5.4
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Medium 4.3
Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.3
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
-
Medium 6.4
Server Side Request Forgery in BookStack
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow t…
-
High 7.7
Cross-Site Scripting in BookStack
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionall…
-
High 7.7
Cross-Site Scripting in BookStack
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you th…
-
Medium 6.3
Cross-site Scripting in BookStack
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displ…
-
High 7.9
Remote Code Execution Through Image Uploads in BookStack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impa…