CVE-2020-5256

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.

• CWE-95
• CWE-434

• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3Release Notes
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4Release Notes
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5Release Notes
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hxThird Party Advisory
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3Release Notes
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4Release Notes
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5Release Notes
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hxThird Party Advisory

Published

Mar 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5250In PrestaShop before version 1.7.6.4, when a customer edits …6.3
• CVE-2020-5251In parser-server before version 4.1.0, you can fetch all the…5.3
• CVE-2020-5252The command-line "safety" package for Python has a potential…4.1
• CVE-2020-5253NetHack before version 3.6.0 allowed malicious use of escapi…9.8
• CVE-2020-5254In NetHack before 3.6.6, some out-of-bound values for the hi…8.1
• CVE-2020-5255In Symfony before versions 4.4.7 and 5.0.7, when a `Response…4.3
• CVE-2020-5257In Administrate (rubygem) before version 0.13.0, when sortin…8.1
• CVE-2020-5258In affected versions of dojo (NPM package), the deepCopy met…7.7
• CVE-2020-5259In affected versions of dojox (NPM package), the jqMix metho…8.6
• CVE-2020-5260Affected versions of Git have a vulnerability whereby Git ca…7.5
• CVE-2020-5261Saml2 Authentication services for ASP.NET (NuGet package Sus…6.8
• CVE-2020-5262In EasyBuild before version 4.1.2, the GitHub Personal Acces…5.5