CVE-2020-5256

BookStack before version 0.25.5 is vulnerable to remote code execution via image uploads, allowing an attacker to upload PHP files and execute code with the PHP process privileges. The issue affects scenarios where non-trusted users can upload images and was addressed by patches in v0.25.3, v0.25...

CVE-2021-4119

BookStack CVE-2021-4119 describes an Improper Access Control vulnerability in BookStack prior to version 21.11.3. The OSV/GHSA entries specify that a logged-in user with no privileges or a guest user (if public access is enabled) can access the /search/users/select endpoint (intended for admins) ...