BookStack vulnerabilities | LiveThreat CVE Feed

Product

BookStack

by Bookstack · last CVE Sep 7, 2026

CVEs

On KEV

6.5

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 3Low 0

Severity

Exploitation

Watch

Add BookStack to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-6199	6.5	1%	Nov 20	Book Stack v23.10.2 - LFR via Blind SSRF Affected: 23.10.2
CVE-2022-40690	5.4	1%	Oct 24	Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script Affected: versions prior to v22.09
CVE-2026-86285	4.3	0%	Sep 7	BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control Affected: 26.05.0; 26.05.1; 26.05.2