Bookstack
Monthly
Authentication bypass in BookStack social login (all versions before 26.05.5) allows unauthenticated attackers to sign in as arbitrary users, enabling full account takeover of both regular accounts and administrators. The flaw is a provider-confusion bug in SocialAuthService::handleLoginCallback, which retrieves linked-account records by driver_id while ignoring the driver column, so an attacker who authenticates at one enabled social provider using a user ID that collides with a victim's driver_id under a different provider is accepted without credential verification. No public exploit identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and successful exploitation requires two enabled social providers sharing an overlapping driver_id namespace plus attacker control of a matching provider account, which is why vendor scoring lands at CVSS 9.1 while our independent vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) caps the attack at high complexity.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
Broken access control in BookStack's Image Gallery API before v26.05.4 allows authenticated API users holding image-update or image-delete permissions to manipulate any other user's profile avatar without requiring user-management privileges. The API controller accepts arbitrary image IDs and skips the content-type and gallery restrictions enforced by the web controller; when the target avatar's uploaded_to field references a page the attacker can already access, the authorization check incorrectly passes. Affected operations include renaming, replacing, or deleting the victim's avatar; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
BookStack chapter export functionality allows unauthenticated remote attackers to bypass access controls via manipulation of the pages parameter in the chapterToMarkdown function, enabling improper access to restricted content. Affects BookStack versions up to 26.03; patch available in version 26.03.1. Publicly available exploit code exists and CVSS 5.5 reflects low confidentiality impact with no integrity or availability compromise.
Book Stack version 23.10.2 allows filtering local files on the server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
bookstack is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
bookstack is vulnerable to Improper Access Control. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Server-Side Request Forgery (SSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
BookStack is a platform for storing and organising information and documentation. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in BookStack social login (all versions before 26.05.5) allows unauthenticated attackers to sign in as arbitrary users, enabling full account takeover of both regular accounts and administrators. The flaw is a provider-confusion bug in SocialAuthService::handleLoginCallback, which retrieves linked-account records by driver_id while ignoring the driver column, so an attacker who authenticates at one enabled social provider using a user ID that collides with a victim's driver_id under a different provider is accepted without credential verification. No public exploit identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and successful exploitation requires two enabled social providers sharing an overlapping driver_id namespace plus attacker control of a matching provider account, which is why vendor scoring lands at CVSS 9.1 while our independent vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) caps the attack at high complexity.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
Broken access control in BookStack's Image Gallery API before v26.05.4 allows authenticated API users holding image-update or image-delete permissions to manipulate any other user's profile avatar without requiring user-management privileges. The API controller accepts arbitrary image IDs and skips the content-type and gallery restrictions enforced by the web controller; when the target avatar's uploaded_to field references a page the attacker can already access, the authorization check incorrectly passes. Affected operations include renaming, replacing, or deleting the victim's avatar; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
BookStack chapter export functionality allows unauthenticated remote attackers to bypass access controls via manipulation of the pages parameter in the chapterToMarkdown function, enabling improper access to restricted content. Affects BookStack versions up to 26.03; patch available in version 26.03.1. Publicly available exploit code exists and CVSS 5.5 reflects low confidentiality impact with no integrity or availability compromise.
Book Stack version 23.10.2 allows filtering local files on the server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
bookstack is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
bookstack is vulnerable to Improper Access Control. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
bookstack is vulnerable to Server-Side Request Forgery (SSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
BookStack is a platform for storing and organising information and documentation. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.