BookStackApp vulnerabilities
We track 4 vulnerabilities in BookStackApp products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest BookStackApp vulnerabilities
- 7.4 High severity
bookstack: Authentication Bypass by Spoofing
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id nam
- 8.7 High severity
bookstack: Improper Neutralization of Input During Web Page Generation
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scr
- 8.8 High severity
bookstack: Unrestricted Upload of File with Dangerous Type
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extens
- 7.5 High severity
bookstack: Improper Neutralization of Input During Web Page Generation
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.