CVE-2026-5484

🗓️ 03 Apr 2026 19:45:12Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 2 Views🌐 WEB

BookStack vulnerability up to 26.03 allows remote page manipulation via chapterToMarkdown, causing access flaws.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-5484	3 Apr 202619:45	–	attackerkb
CNNVD	BookStack 访问控制错误漏洞	3 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-5484 BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control	3 Apr 202619:45	–	cvelist
EUVD	EUVD-2026-18819	3 Apr 202621:31	–	euvd
NVD	CVE-2026-5484	3 Apr 202620:16	–	nvd
Positive Technologies	PT-2026-30222	3 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-5484	6 Apr 202617:00	–	redhatcve

Vulners

Node

bookstackapp bookstackMatch26.03

[
  {
    "vendor": "BookStackApp",
    "product": "BookStack",
    "versions": [
      {
        "version": "26.03",
        "status": "affected"
      },
      {
        "version": "26.03.1",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Chapter Export Handler"
    ]
  }
]

Source	Link
github	www.github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04
vuldb	www.vuldb.com/vuln/355091
github	www.github.com/BookStackApp/BookStack/releases/tag/v26.03.1
github	www.github.com/BookStackApp/BookStack/
bookstackapp	www.bookstackapp.com/blog/bookstack-release-v26-03-1/
vuldb	www.vuldb.com/vuln/355091/cti
vuldb	www.vuldb.com/submit/781762
github	www.github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export

Parameter	Position	Path	Description	CWE
pages	request body	app/Exports/ExportFormatter.php	Manipulation of the pages argument during chapter export can lead to improper access controls.	CWE-284, CWE-266

24 Apr 2026 18:13Current

5.7Medium risk

Vulners AI Score5.7

CVSS 25

CVSS 3.15.3

CVSS 46.9

CVSS 35.3

EPSS0.00049