Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-5256: BookStack Image Uploads Can Execute Code Remotely
CVE-2020-5256 · published 6 years ago
Summary
BookStack's image upload feature allows users to execute code on the server if they upload a malicious PHP file. This is a serious risk if users with permission to upload images are not trusted. To fix this, update to at least BookStack version 0.25.5, or use alternative image storage like local_secure or an S3 service to prevent unauthorized code execution.
What to do
- Update ssddanbrown bookstack to version 0.25.5.
- Update bookstackapp bookstack to version 0.25.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | ssddanbrown | bookstack |
< 0.25.3 Fix: upgrade to 0.25.5
|
| – | bookstackapp | bookstack |
< 0.25.3 cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:* |
Original advisory text
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They woul...
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-5256
- https://github.com/advisories/GHSA-g9rq-x4fj-f5hx
- https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3 Release Notes
- https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4 Release Notes
- https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5 Release Notes
- https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5h... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
8.8
High
Type
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-434Unrestricted File Upload
Timeline
Published9 Mar 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta