Product by BookStackApp
BookStack
29 known vulnerabilities in BookStack (BookStackApp), 0 of them actively exploited (CISA KEV).
Key figures
29
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-4119 | Improper Access Control in bookstackapp/bookstack | 5.3 | |
| High | CVE-2026-82450 | BookStack before 26.05.4 Remote Code Execution via Book Cover | 8.8 | |
| High | CVE-2020-5256 | Remote Code Execution Through Image Uploads in BookStack | 7.9 | |
| Critical | CVE-2026-89022 | BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion | 7.4 | |
| Critical | CVE-2026-84695 | BookStack before 26.05.4 Stored XSS via Drawing Upload | 8.7 | |
| Medium | CVE-2023-6199 | Book Stack v23.10.2 - LFR via Blind SSRF | 6.5 | |
| High | CVE-2020-26210 | Cross-Site Scripting in BookStack | 7.7 | |
| High | CVE-2020-26211 | Cross-Site Scripting in BookStack | 7.7 | |
| Medium | CVE-2021-3916 | Path Traversal in bookstackapp/bookstack | 6.5 | |
| High | CVE-2021-3915 | Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack | 7.6 | |
| High | CVE-2022-0877 | Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack | 7.6 | |
| Medium | CVE-2021-4026 | Improper Access Control in bookstackapp/bookstack | 6.5 | |
| Medium | CVE-2026-126811 | BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints | 5.4 | |
| Medium | CVE-2026-67204 | BookStack < 26.05.4 Broken Access Control via Image Gallery API | 5.4 | |
| Medium | CVE-2020-26260 | Server Side Request Forgery in BookStack | 6.4 | |
| Medium | CVE-2021-3874 | Path Traversal in bookstackapp/bookstack | 4.3 | |
| Medium | CVE-2021-3758 | Server-Side Request Forgery (SSRF) in bookstackapp/bookstack | 6.3 | |
| Medium | CVE-2026-116020 | BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages | 5.4 | |
| Medium | CVE-2022-40690 | BookStack: Cross-Site Scripting (XSS) | 5.4 | |
| Medium | CVE-2020-11055 | Cross-site Scripting in BookStack | 6.3 | |
| Medium | CVE-2026-5484 | BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control | 5.3 | |
| Medium | CVE-2017-1000462 | BookStack: Cross-Site Scripting (XSS) | 5.4 | |
| Medium | CVE-2026-125870 | BookStack before 26.09.3 Broken Access Control via ImageController | 4.2 | |
| Medium | CVE-2021-3906 | Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack | 5.4 | |
| Medium | CVE-2021-4194 | Improper Access Control in bookstackapp/bookstack | 4.3 |