CVE-2020-26210
CVSS v3
8.7
HIGH
EPSS Score
1.2 %
exploit probability, as of 2026-09-25
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
Technical details
- Published
- 2020-11-03
Frequently asked questions
What is CVE-2020-26210?
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
Is CVE-2020-26210 actively exploited?
Active exploitation of CVE-2020-26210 has not been confirmed. Its EPSS score was 1.2% on 2026-09-25, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2020-26210?
CVE-2020-26210 has a CVSS v3 base score of 8.7 (HIGH severity).
Is CVE-2020-26210 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2020 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).