Vendor

    BookStackApp

    29 known vulnerabilities in products by BookStackApp, 0 of them actively exploited (CISA KEV).

    Key figures

    29

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in BookStackApp
    CriticalCVE-2021-4119

    Improper Access Control in bookstackapp/bookstack

    		5.3
    HighCVE-2026-82450

    BookStack before 26.05.4 Remote Code Execution via Book Cover

    		8.8
    HighCVE-2020-5256

    Remote Code Execution Through Image Uploads in BookStack

    		7.9
    CriticalCVE-2026-89022

    BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

    		7.4
    CriticalCVE-2026-84695

    BookStack before 26.05.4 Stored XSS via Drawing Upload

    		8.7
    MediumCVE-2023-6199

    Book Stack v23.10.2 - LFR via Blind SSRF

    		6.5
    HighCVE-2020-26210

    Cross-Site Scripting in BookStack

    		7.7
    HighCVE-2020-26211

    Cross-Site Scripting in BookStack

    		7.7
    MediumCVE-2021-3916

    Path Traversal in bookstackapp/bookstack

    		6.5
    HighCVE-2021-3915

    Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack

    		7.6
    HighCVE-2022-0877

    Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

    		7.6
    MediumCVE-2021-4026

    Improper Access Control in bookstackapp/bookstack

    		6.5
    MediumCVE-2026-126811

    BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

    		5.4
    MediumCVE-2026-67204

    BookStack < 26.05.4 Broken Access Control via Image Gallery API

    		5.4
    MediumCVE-2020-26260

    Server Side Request Forgery in BookStack

    		6.4
    MediumCVE-2021-3874

    Path Traversal in bookstackapp/bookstack

    		4.3
    MediumCVE-2021-3758

    Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

    		6.3
    MediumCVE-2026-116020

    BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

    		5.4
    MediumCVE-2022-40690

    BookStack: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2020-11055

    Cross-site Scripting in BookStack

    		6.3
    MediumCVE-2026-5484

    BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

    		5.3
    MediumCVE-2017-1000462

    BookStack: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2026-125870

    BookStack before 26.09.3 Broken Access Control via ImageController

    		4.2
    MediumCVE-2021-3906

    Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack

    		5.4
    MediumCVE-2021-4194

    Improper Access Control in bookstackapp/bookstack

    		4.3

    All vulnerabilities in search

    Products

    Products by BookStackApp
    BookStack290
    Bookstackapp/bookstack130