# ssddanbrown/bookstack (Packagist) vulnerabilities

10 known vulnerabilities (5 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/ssddanbrown/bookstack

## Advisories (10)

### [CVE-2024-36676](https://cve.now/CVE-2024-36676): Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification…

- Severity: High 7.5
- Published: Jul 9, 2024
- Affected: fixed in 24.05.1.

### [CVE-2022-0877](https://cve.now/CVE-2022-0877): Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

- Severity: High 7.6
- Published: Mar 8, 2022
- Affected: fixed in 22.02.3.

### [CVE-2021-4194](https://cve.now/CVE-2021-4194): Improper Access Control in bookstackapp/bookstack

- Severity: Medium 4.3
- Published: Jan 6, 2022
- Affected: fixed in 21.12.1.

### [CVE-2021-4119](https://cve.now/CVE-2021-4119): Improper Access Control in bookstackapp/bookstack

- Severity: Medium 5.3
- Published: Dec 15, 2021
- Affected: fixed in 21.11.3.

### [CVE-2021-3944](https://cve.now/CVE-2021-3944): Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack

- Severity: Low 3.1
- Published: Dec 2, 2021
- Affected: fixed in 21.11.

### [CVE-2021-4026](https://cve.now/CVE-2021-4026): Improper Access Control in bookstackapp/bookstack

- Severity: Medium 6.5
- Published: Nov 30, 2021
- Affected: fixed in 21.11.2.

### [CVE-2021-3915](https://cve.now/CVE-2021-3915): Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack

- Severity: High 7.6
- Published: Nov 13, 2021
- Affected: fixed in 21.0.3.

### [CVE-2020-26211](https://cve.now/CVE-2020-26211): Cross-Site Scripting in BookStack

- Severity: High 7.7
- Published: Nov 3, 2020
- Affected: fixed in 0.30.4.

### [CVE-2020-11055](https://cve.now/CVE-2020-11055): Cross-site Scripting in BookStack

- Severity: Medium 6.3
- Published: May 7, 2020
- Affected: from 0.18.0, fixed in 0.29.2.

### [CVE-2020-5256](https://cve.now/CVE-2020-5256): Remote Code Execution Through Image Uploads in BookStack

- Severity: High 7.9
- Published: Mar 9, 2020
- Affected: fixed in 0.25.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/ssddanbrown/bookstack
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.