CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.

• CWE-79
• CWE-79

• http://jvn.jp/en/jp/JVN41035278/index.htmlThird Party Advisory
• https://bookstackapp.com/blog/beta-release-v0-29-2/Release Notes, Vendor Advisory
• https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2Release Notes
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6wThird Party Advisory
• http://jvn.jp/en/jp/JVN41035278/index.htmlThird Party Advisory
• https://bookstackapp.com/blog/beta-release-v0-29-2/Release Notes, Vendor Advisory
• https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2Release Notes
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6wThird Party Advisory

Published

May 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1105A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-11050In Java-WebSocket less than or equal to 1.4.1, there is an I…8.1
• CVE-2020-11051In Wiki.js before 2.3.81, there is a stored XSS in the Markd…4.8
• CVE-2020-11052In Sorcery before 0.15.0, there is a brute force vulnerabili…9.8
• CVE-2020-11053In OAuth2 Proxy before 5.1.1, there is an open redirect vuln…6.1
• CVE-2020-11054In qutebrowser versions less than 1.11.1, reloading a page w…3.5
• CVE-2020-11056In Sprout Forms before 3.9.0, there is a potential Server-Si…6.3
• CVE-2020-11057In XWiki Platform 7.2 through 11.10.2, registered users with…8.8
• CVE-2020-11058In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bound…2.2
• CVE-2020-11059In AEgir greater than or equal to 21.7.0 and less than 21.10…7.5
• CVE-2020-1106A cross-site-scripting (XSS) vulnerability exists when Micro…6.1
• CVE-2020-11060In GLPI before 9.4.6, an attacker can execute system command…8.8