Skip to content

BookStackApp · product

bookstackapp/bookstack

13 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
1

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

  1. Improper Access Control in bookstackapp/bookstackCVE-2021-4119bookstackapp · CVSS 5.3 · 27% likely

    CWE-284

  2. Path Traversal in bookstackapp/bookstackCVE-2021-3916bookstackapp · CVSS 6.5 · 1.2% likely

    CWE-22

  3. Path Traversal in bookstackapp/bookstackCVE-2021-3874bookstackapp · CVSS 4.3 · 1.2% likely

    CWE-22

  4. Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstackCVE-2021-3915bookstackapp · CVSS 7.6 · 1.0% likely

    CWE-434

  5. Improper Access Control in bookstackapp/bookstackCVE-2021-4026bookstackapp · CVSS 6.5 · 0.9% likely

    CWE-284

  6. Server-Side Request Forgery (SSRF) in bookstackapp/bookstackCVE-2021-3758bookstackapp · CVSS 6.3 · 0.8% likely

    CWE-918

  7. Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackCVE-2022-0877bookstackapp · CVSS 7.6 · 0.8% likely

    CWE-79

  8. Improper Access Control in bookstackapp/bookstackCVE-2021-4194bookstackapp · CVSS 4.3 · 0.7% likely

    CWE-284

  9. Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstackCVE-2021-3906bookstackapp · CVSS 5.4 · 0.7% likely

    CWE-434

  10. Cross-Site Request Forgery (CSRF) in bookstackapp/bookstackCVE-2021-3944bookstackapp · CVSS 3.1 · 0.6% likely

    CWE-352

  11. Server-Side Request Forgery (SSRF) in bookstackapp/bookstackCVE-2023-4624bookstackapp · CVSS 2.4 · 0.6% likely

    CWE-918

  12. Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackCVE-2021-3768bookstackapp · CVSS 5.4 · 0.6% likely

    CWE-79

  13. Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackCVE-2021-3767bookstackapp · CVSS 5.4 · 0.6% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

Updated AboutDevelopersSign in