CVE-2020-5256 Remote Code Execution Through Image Uploads in BookStack

What is CVE-2020-5256?

CVE-2020-5256 is a high-severity vulnerability in BookStackApp BookStack, published on 9 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.

Weakness: CWE-434, CWE-95

Which versions are affected by CVE-2020-5256?

2 open source packages ship an affected version, including ssddanbrown/bookstack. It affects 1 product.

Products include Bookstackapp Bookstack.

How do I fix CVE-2020-5256?

Upgrade ssddanbrown/bookstack to 0.25.5 or later.

Is CVE-2020-5256 being exploited?

There is no known exploitation of CVE-2020-5256 in the wild and no public exploit code.

Other vulnerabilities in BookStackApp BookStack

• CVE-2020-26210 Cross-Site Scripting in BookStack High 7.7
• CVE-2020-26211 Cross-Site Scripting in BookStack High 7.7
• CVE-2022-0877 Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack High 7.6
• CVE-2021-3915 Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack High 7.6
• CVE-2023-6199 Book Stack v23.10.2 - LFR via Blind SSRF Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g9rq-x4fj-f5hx.