EUVD-2026-18819
GHSA-h29h-hh8g-q4wh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.5 with vector AV:N/AC:L/PR:N/UI:N indicates network-accessible, low-complexity attack requiring no user interaction or privileges-a straightforward exploitation path. However, CVSS impact metrics show VC:L (low confidentiality impact) with VI:N/VA:N (no integrity or availability impact), limiting real-world damage to information disclosure. The E:P tag (exploit proof-of-concept exists) combined with public availability on GitHub confirms reproducibility. SSVC analysis: exploitation is functional (POC available), automatable via parameter manipulation, with technical impact limited to confidential information exposure. This is a legitimate priority for organizations using BookStack to store sensitive documentation, but the impact is confined to unauthorized data reading rather than system compromise. Organizations using older versions with public-facing BookStack instances should treat this as moderate priority due to unauthenticated remote attack vector. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts a malicious chapter export request by manipulating the pages parameter to include pages they should not have access to, then exports the chapter to markdown format. The export handler fails to validate access controls, returning the restricted content in the exported file. The attacker gains unauthorized read access to sensitive documentation without authentication. Publicly available exploit code on GitHub demonstrates this attack path clearly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
BookStack chapter export functionality allows unauthenticated remote attackers to bypass access controls via manipulation of the pages parameter in the chapterToMarkdown function, enabling improper access to restricted content. Affects BookStack versions up to 26.03; patch available in version 26.03.1. Publicly available exploit code exists and CVSS 5.5 reflects low confidentiality impact with no integrity or availability compromise.
RemediationAI
Vendor-released patch: upgrade to BookStack version 26.03.1 or later. The specific patch commit 8a59895ba063040cc8dafd82e94024c406df3d04 is available on GitHub. Users unable to upgrade immediately should restrict network access to BookStack instances and review export functionality logs for unauthorized chapter access attempts. Official vendor advisory and release notes are available at https://www.bookstackapp.com/blog/bookstack-release-v26-03-1/ and https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in BookStack's export functionality, specifically the chapterToMarkdown method within app/Exports/ExportFormatter.php. BookStack is a PHP-based documentation and wiki platform. The root cause is classified as CWE-284 (Improper Access Control), indicating insufficient validation of the pages parameter during chapter export operations. This parameter manipulation allows attackers to circumvent intended access restrictions without requiring authentication, as confirmed by the CVSS vector showing PR:N (no privileges required) and AV:N (network-accessible). The export handler fails to properly validate which pages a user is authorized to access before including them in the exported markdown output.
Know when Bookstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba063040cc8dafd82e94024c406df3d04. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
bookstack is vulnerable to Improper Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execut
bookstack is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.8), this vulnerability is re
Book Stack version 23.10.2 allows filtering local files on the server. Rated medium severity (CVSS 6.5), this vulnerabil
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 6.5), this vulne
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium
bookstack is vulnerable to Server-Side Request Forgery (SSRF). Rated medium severity (CVSS 6.5), this vulnerability is r
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 5.7), this vulne
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. Rated medium severity
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated m
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated m
Exploit-DB