What’s Vulnerable › Products

bookstackapp/bookstack vulnerabilities

28 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your bookstackapp/bookstack version is affected

Latest bookstackapp/bookstack vulnerabilities

• CVE-2026-116020 — BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages (CVSS 5.4)
• CVE-2026-89022 — BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion (CVSS 7.4)
• CVE-2026-84695 — BookStack before 26.05.4 Stored XSS via Drawing Upload (CVSS 8.7)
• CVE-2026-82450 — BookStack before 26.05.4 Remote Code Execution via Book Cover (CVSS 8.8)
• CVE-2026-67204 — BookStack < 26.05.4 Broken Access Control via Image Gallery API (CVSS 5.4)
• CVE-2026-5484 — BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control (CVSS 5.3)
• CVE-2024-36676 — (CVSS 7.5)
• CVE-2023-6199 — Book Stack v23.10.2 - LFR via Blind SSRF (CVSS 6.5)
• CVE-2023-4624 — Server-Side Request Forgery (SSRF) in bookstackapp/bookstack (CVSS 2.4)
• CVE-2022-40690 — (CVSS 5.4)
• CVE-2022-0877 — Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 5.4)
• CVE-2021-4194 — Improper Access Control in bookstackapp/bookstack (CVSS 6.5)
• CVE-2021-4119 — Improper Access Control in bookstackapp/bookstack (CVSS 9.8)
• CVE-2021-3944 — Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack (CVSS 6.8)
• CVE-2021-4026 — Improper Access Control in bookstackapp/bookstack (CVSS 4.3)
• CVE-2021-3915 — Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (CVSS 5.7)
• CVE-2021-3916 — Path Traversal in bookstackapp/bookstack (CVSS 6.5)
• CVE-2021-3906 — Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (CVSS 6.5)
• CVE-2021-3874 — Path Traversal in bookstackapp/bookstack (CVSS 6.5)
• CVE-2021-3768 — Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 5.4)
• CVE-2021-3767 — Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 5.4)
• CVE-2021-3758 — Server-Side Request Forgery (SSRF) in bookstackapp/bookstack (CVSS 6.5)
• CVE-2020-26260 — Server Side Request Forgery in BookStack (CVSS 6.4)
• CVE-2020-26211 — Cross-Site Scripting in BookStack (CVSS 8.7)
• CVE-2020-26210 — Cross-Site Scripting in BookStack (CVSS 8.7)