PT-2026-30222 · Bookstackapp+1 · Bookstack

Ghufran Khan · CVE-2026-5484 · Publicado 2026-04-03 · Atualizado 2026-07-20

Positive Technologies (AI Summary) · Pt

CVSS v4.0

5.5

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Nome do Software Vulnerável e Versões Afetadas BookStack versões anteriores a 26.03.1

Description Um problema existe no componente Chapter Export Handler dentro da função chapterToMarkdown() do arquivo app/Exports/ExportFormatter.php. Um invasor remoto pode manipular o argumento pages para contornar os controles de acesso.

Recommendations Atualizar para a versão 26.03.1.

Exploit

Correção

Improper Access Control

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-284

CWE-266

Identificadores relacionados

CVE-2026-5484

Produtos afetados

Bookstack

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5484.json · Exploit
• 🔥 https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export · Exploit
• https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1 · Correção
• https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04 · Correção
• https://vuldb.com/vuln/355091/cti · Nota
• https://osv.dev/vulnerability/CVE-2026-5484 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-5484 · Nota de Segurança
• https://vuldb.com/submit/781762 · Nota
• https://t.me/cveNotify/208080 · Publicação no Telegram
• https://vuldb.com/vuln/355091 · Nota
• https://bookstackapp.com/blog/bookstack-release-v26-03-1 · Nota
• https://github.com/BookStackApp/BookStack · Nota