CVE-2020-5256
Remote Code Execution Through Image Uploads in BookStack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Remote Code Execution Through Image Uploads in BookStack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Record
CVE-2020-5256- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-95
- Updated
- 2026-11-02
EUVDEUVD-2020-0345
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Record
EUVD-2020-0345- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g9rq-x4fj-f5hx
Remote Code Execution Through Image Uploads in BookStack
Impact
A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process.
This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application.
Patches
The issue was addressed in a series of patches: v0.25.3, v0.25.4 and v0.25.5. Users should upgrade to at least v0.25.5 to avoid this patch but ideally the latest BookStack version as previous versions are un-supported.
Workarounds
Depending on BookStack version, you could use the local_secure image storage option, or use s3 or a similar compatible service.
Preventing direct execution of any php files, apart from the public/index.php file, though web-server configuration would also prevent this.
References
BookStack Beta v0.25.3 BookStack Beta v0.25.4 BookStack Beta v0.25.5
For more information
If you have any questions or comments about this advisory:
- Open an issue in the BookStack GitHub repository.
- Ask on the BookStack Discord chat.
- Follow the BookStack Security advise to contact someone privately.
- Record
GHSA-g9rq-x4fj-f5hx- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-95
- Updated
- 2026-11-02
NVD
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Record
CVE-2020-5256- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-95, CWE-434
- Updated
- 2026-11-02
OSV
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Record
CVE-2020-5256- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g9rq-x4fj-f5hx
Remote Code Execution Through Image Uploads in BookStack
Impact
A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process.
This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application.
Patches
The issue was addressed in a series of patches: v0.25.3, v0.25.4 and v0.25.5. Users should upgrade to at least v0.25.5 to avoid this patch but ideally the latest BookStack version as previous versions are un-supported.
Workarounds
Depending on BookStack version, you could use the local_secure image storage option, or use s3 or a similar compatible service.
Preventing direct execution of any php files, apart from the public/index.php file, though web-server configuration would also prevent this.
References
BookStack Beta v0.25.3 BookStack Beta v0.25.4 BookStack Beta v0.25.5
For more information
If you have any questions or comments about this advisory:
- Open an issue in the BookStack GitHub repository.
- Ask on the BookStack Discord chat.
- Follow the BookStack Security advise to contact someone privately.
- Record
GHSA-g9rq-x4fj-f5hx- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-95
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ssddanbrown/bookstackPackagist |
before 0.25.3 | 0.25.3 |
ssddanbrown/bookstackPackagist |
before 0.25.5, plus listed versions 0.7.2V0.7.5v0.10.0v0.11.0v0.11.1 Show 45 moreShow lessv0.11.2v0.12.0v0.12.1v0.12.2v0.13.0v0.13.1v0.14.0v0.14.1v0.14.2v0.14.3v0.15.0v0.15.1v0.15.2v0.15.3v0.16.0v0.16.1v0.16.2v0.16.3v0.17.0v0.17.1v0.17.2v0.17.3v0.17.4v0.18.0v0.18.1v0.18.2v0.18.3v0.18.4v0.18.5v0.19.0v0.20.0v0.20.1v0.20.2v0.20.3v0.21.0v0.22.0v0.23.0v0.23.1v0.23.2v0.24.0v0.24.1v0.24.2v0.24.3v0.25.0v0.25.1 |
0.25.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-5256 is a high vulnerability (CVSS 7.9) in Bookstackapp Bookstack, published March 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in ssddanbrown/bookstack 0.25.3.
References
github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hx
nvd.nist.gov/vuln/detail/CVE-2020-5256
Left out here: 19 versions. The JSON record has them.