Bookstack
Bookstackapp · 25 CVEs
BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
Sep 15, 2026
BookStack before 26.05.4 Stored XSS via Drawing Upload
Sep 2, 2026
BookStack before 26.05.4 Remote Code Execution via Book Cover
Aug 29, 2026
BookStack < 26.05.4 Broken Access Control via Image Gallery API
Aug 24, 2026
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
Apr 3, 2026
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform tar…
Jul 9, 2024
Book Stack v23.10.2 - LFR via Blind SSRF
Nov 20, 2023
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
Aug 30, 2023
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inje…
Oct 24, 2022
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Mar 8, 2022
Improper Access Control in bookstackapp/bookstack
Jan 6, 2022
Improper Access Control in bookstackapp/bookstack
Dec 15, 2021
Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack
Dec 2, 2021
Improper Access Control in bookstackapp/bookstack
Nov 30, 2021
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
Nov 13, 2021
Path Traversal in bookstackapp/bookstack
Nov 5, 2021
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
Oct 27, 2021
Path Traversal in bookstackapp/bookstack
Oct 15, 2021
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Sep 6, 2021
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Sep 6, 2021
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
Sep 2, 2021
Server Side Request Forgery in BookStack
Dec 9, 2020
Cross-Site Scripting in BookStack
Nov 3, 2020
Cross-Site Scripting in BookStack
Nov 3, 2020
Cross-site Scripting in BookStack
May 7, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-89022 | BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion | CRITICAL | 0.46% | Sep 15, 2026 |
| CVE-2026-84695 | BookStack before 26.05.4 Stored XSS via Drawing Upload | CRITICAL | 0.47% | Sep 2, 2026 |
| CVE-2026-82450 | BookStack before 26.05.4 Remote Code Execution via Book Cover | HIGH | 1.00% | Aug 29, 2026 |
| CVE-2026-67204 | BookStack < 26.05.4 Broken Access Control via Image Gallery API | MEDIUM | 0.41% | Aug 24, 2026 |
| CVE-2026-5484 | BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control | MEDIUM | 0.55% | Apr 3, 2026 |
| CVE-2024-36676 | Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public… | HIGH | 0.65% | Jul 9, 2024 |
| CVE-2023-6199 | Book Stack v23.10.2 - LFR via Blind SSRF | MEDIUM | 1.38% | Nov 20, 2023 |
| CVE-2023-4624 | Server-Side Request Forgery (SSRF) in bookstackapp/bookstack | LOW | 0.63% | Aug 30, 2023 |
| CVE-2022-40690 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. | MEDIUM | 0.77% | Oct 24, 2022 |
| CVE-2022-0877 | Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack | MEDIUM | 0.78% | Mar 8, 2022 |
| CVE-2021-4194 | Improper Access Control in bookstackapp/bookstack | MEDIUM | 0.71% | Jan 6, 2022 |
| CVE-2021-4119 | Improper Access Control in bookstackapp/bookstack | CRITICAL | 26.89% | Dec 15, 2021 |
| CVE-2021-3944 | Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack | MEDIUM | 0.64% | Dec 2, 2021 |
| CVE-2021-4026 | Improper Access Control in bookstackapp/bookstack | MEDIUM | 0.93% | Nov 30, 2021 |
| CVE-2021-3915 | Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack | MEDIUM | 0.96% | Nov 13, 2021 |
| CVE-2021-3916 | Path Traversal in bookstackapp/bookstack | MEDIUM | 1.24% | Nov 5, 2021 |
| CVE-2021-3906 | Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack | MEDIUM | 0.67% | Oct 27, 2021 |
| CVE-2021-3874 | Path Traversal in bookstackapp/bookstack | MEDIUM | 1.20% | Oct 15, 2021 |
| CVE-2021-3768 | Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack | MEDIUM | 0.58% | Sep 6, 2021 |
| CVE-2021-3767 | Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack | MEDIUM | 0.58% | Sep 6, 2021 |
| CVE-2021-3758 | Server-Side Request Forgery (SSRF) in bookstackapp/bookstack | MEDIUM | 0.80% | Sep 2, 2021 |
| CVE-2020-26260 | Server Side Request Forgery in BookStack | MEDIUM | 0.84% | Dec 9, 2020 |
| CVE-2020-26211 | Cross-Site Scripting in BookStack | HIGH | 1.10% | Nov 3, 2020 |
| CVE-2020-26210 | Cross-Site Scripting in BookStack | HIGH | 1.17% | Nov 3, 2020 |
| CVE-2020-11055 | Cross-site Scripting in BookStack | MEDIUM | 0.78% | May 7, 2020 |
Showing 1 to 25 of 25 CVEs