BookStackApp BookStack vulnerabilities

CVEs per yearBy the year they were published

1. 20205
2. 20266

Newest CVEs

• CVE-2026-116020

  BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

  BookStackApp · BookStack

  Medium5.3
• CVE-2026-89022

  BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

  bookstackapp · bookstack

  Critical9.1
• CVE-2026-84695

  BookStack before 26.05.4 Stored XSS via Drawing Upload

  bookstackapp · bookstack

  Critical9.3
• CVE-2026-82450

  BookStack before 26.05.4 Remote Code Execution via Book Cover

  bookstackapp · bookstack

  High8.7
• CVE-2026-67204

  BookStack < 26.05.4 Broken Access Control via Image Gallery API

  BookStackApp · BookStack

  Medium5.3
• CVE-2026-5484

  BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

  BookStackApp · BookStack

  Medium6.9
• CVE-2020-26260

  Server Side Request Forgery in BookStack

  BookStackApp · BookStack

  Medium6.4
• CVE-2020-26211

  Cross-Site Scripting in BookStack

  BookStackApp · BookStack

  High7.7
• CVE-2020-26210

  Cross-Site Scripting in BookStack

  BookStackApp · BookStack

  High7.7
• CVE-2020-11055

  Cross-site Scripting in BookStack

  BookStackApp · BookStack

  Medium6.3