BookStackApp vulnerabilities

CVEs per yearBy the year they were published

1. 20205
2. 202110
3. 20222
4. 20231
5. 20266

Newest CVEs

• CVE-2026-116020

  BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

  BookStackApp · BookStack

  Medium5.3
• CVE-2026-89022

  BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

  bookstackapp · bookstack

  Critical9.1
• CVE-2026-84695

  BookStack before 26.05.4 Stored XSS via Drawing Upload

  bookstackapp · bookstack

  Critical9.3
• CVE-2026-82450

  BookStack before 26.05.4 Remote Code Execution via Book Cover

  bookstackapp · bookstack

  High8.7
• CVE-2026-67204

  BookStack < 26.05.4 Broken Access Control via Image Gallery API

  BookStackApp · BookStack

  Medium5.3
• CVE-2026-5484

  BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

  BookStackApp · BookStack

  Medium6.9
• CVE-2023-4624

  Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

  bookstackapp · bookstackapp/bookstack

  Low2.4
• CVE-2022-0877

  Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

  bookstackapp · bookstackapp/bookstack

  High7.6
• CVE-2021-4194

  Improper Access Control in bookstackapp/bookstack

  bookstackapp · bookstackapp/bookstack

  Medium4.3
• CVE-2021-4119

  Improper Access Control in bookstackapp/bookstack

  bookstackapp · bookstackapp/bookstack

  Medium5.3