How many CVEs have a located fix in bookstackapp/bookstack?

19 published CVEs have a fix traced to functions in bookstackapp/bookstack, touching 89 functions across 49 files.

Which function in bookstackapp/bookstack has been patched by the most CVEs?

destroyImagesFromPath in app/Uploads/ImageService.php has been changed by 2 CVE fixes, from 2021 to 2021.

How large is a typical CVE fix in bookstackapp/bookstack?

The median fix changes 41 lines. 26% of fixes change 20 lines or fewer, and 11% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#281 of 500 repositories

bookstackapp/bookstack

Name: bookstackapp/bookstack: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 2, 2026

19

CVE fixes located

Published CVEs

89

Functions patched

Distinct function sites

49

Files patched

Distinct source files

2020–2026

Years covered

By CVE publication date

Overview

19 published CVEs have a fix traced to functions in bookstackapp/bookstack, the earliest published in 2020. Those fixes changed 89 distinct functions across 49 files, in 261 patch hunks.

Among the 500 repositories tracked here, bookstackapp/bookstack ranks #281 by the number of CVEs with a located fix.

Most patched functions

Functions in bookstackapp/bookstack changed by the most CVE fixes.

Most patched files

Files in bookstackapp/bookstack changed by the most CVE fixes.

1app/Uploads/ImageService.php4 CVEs · 13 functions
2app/Uploads/AttachmentService.php3 CVEs · 11 functions
3app/Config/app.php3 CVEs · 0 functions
4app/Entities/Tools/ExportFormatter.php2 CVEs · 5 functions
5app/Util/HtmlContentFilter.php2 CVEs · 3 functions
6app/Exports/ZipExports/ZipImportRunner.php1 CVEs · 4 functions
7app/Util/CspService.php1 CVEs · 4 functions
8app/Auth/Permissions/PermissionService.php1 CVEs · 3 functions
9app/Access/Controllers/ForgotPasswordController.php1 CVEs · 2 functions
10app/Entities/Tools/BookContents.php1 CVEs · 2 functions

Fix size

How much code a CVE fix in bookstackapp/bookstack changes, with backports counted once.

41

Median lines changed

Added plus removed, per CVE

26%

Fixes of 20 lines or fewer

Share of CVE fixes

11%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in bookstackapp/bookstack, and the functions each fix changed.

BookStack before 26.05.4 Stored XSS via Drawing Upload
CVE-2026-84695streamImageFromStorageResponse size
Critical · CVSS 9.3
EPSS 0.5%2026-09-02
BookStack before 26.05.4 Remote Code Execution via Book Cover
CVE-2026-82450zipFileToUploadedFile getSupportedMimeTypes importImage
High · CVSS 8.7
EPSS 1.0%2026-08-29
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
CVE-2026-5484getHeaders chapterToMarkdown
Medium · CVSS 6.9
EPSS 0.5%2026-04-03
BookStack Incorrect Access Control vulnerability
CVE-2024-36676__construct configureRateLimiting sendResetLinkEmail
High · CVSS 8.8
EPSS 0.6%2024-07-09
CVE-2023-4624
CVE-2023-4624SsrUrlValidator handle
Low · CVSS 2.4
EPSS 0.6%2023-08-30
Cross-site Scripting in BookStack
CVE-2022-0877setScriptSrc setFrameAncestors getAllowedIframeSources
Medium · CVSS 5.4
EPSS 0.8%2022-03-08
bookstack is vulnerable to Improper Access Control
CVE-2021-4194sortUsingMap BookSortMap BookSortMapItem
Medium · CVSS 6.5
EPSS 0.7%2022-01-06
BookStack is vulnerable to Improper Access Control.
CVE-2021-4119forSelect getAllUsers UserSearchController
Critical · CVSS 9.8
EPSS 26.9%2021-12-15
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3944setPassword __construct confirm
Medium · CVSS 6.8
EPSS 0.6%2021-12-02
bookstack is vulnerable to Improper Access Control
CVE-2021-4026filterRelatedEntity enforceEntityRestrictions renderApiException
Medium · CVSS 4.3
EPSS 0.9%2021-11-30
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2021-3915WebSafeMimeSniffer inlineDownloadResponse downloadResponse
Medium · CVSS 5.7
EPSS 1.0%2021-11-13
CVE-2021-3916
CVE-2021-3916pathExistsInLocalSecure getStorage __construct
Medium · CVSS 6.5
EPSS 1.2%2021-11-05

Get an alert for each new bookstackapp/bookstack CVE, with the patched functions and AI-written analysis.

Monitor bookstack CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

1Panel-dev/MaxKB19 CVEs alextselegidis/easyappointments19 CVEs baserproject/basercms19 CVEs cloudfoundry/uaa19 CVEs debian/dovecot19 CVEs debian/nginx19 CVEs debian/openimageio19 CVEs denoland/deno19 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in bookstackapp/bookstack.

How many CVEs have a located fix in bookstackapp/bookstack?: 19 published CVEs have a fix traced to functions in bookstackapp/bookstack, touching 89 functions across 49 files.
Which function in bookstackapp/bookstack has been patched by the most CVEs?: destroyImagesFromPath in app/Uploads/ImageService.php has been changed by 2 CVE fixes, from 2021 to 2021.
How large is a typical CVE fix in bookstackapp/bookstack?: The median fix changes 41 lines. 26% of fixes change 20 lines or fewer, and 11% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track bookstackapp/bookstack CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing