CVE-2026-125870

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

CVE-2026-125870 BookStack before 26.09.3 Broken Access Control via ImageController

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

EUVD-2026-124394

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

CVE-2026-125870

BookStack versions before 26.09.3 are vulnerable to a missing authorization flaw in ImageController::checkImagePermission(). The vulnerability occurs because the permission check relies on Page::getPage(), which returns null for soft-deleted pages in the recycle bin, causing the system to silentl...

GHSA-5P82-2Q3R-WJ3M ThingsBoard allows an authenticated user to upload malicious SVG images

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-34281

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-34281: Improper Neutralization of Input During Web Page Generation

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

Server side request forgery (ssrf)

A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function downloadnetworkimage of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack...