CVE-2021-3915

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
bookstackapp	bookstackapp/bookstack	>= unspecified, < 21.10.3

References

https://github.com/bookstackapp/bookstack/commit/ae155d67454d6b9f6c93b2bb457aaa4b2eb1a9edPatch, Third Party Advisory
https://huntr.dev/bounties/fcb65f2d-257a-46f4-bac9-f6ded5649079Exploit, Patch, Third Party Advisory
https://github.com/bookstackapp/bookstack/commit/ae155d67454d6b9f6c93b2bb457aaa4b2eb1a9edPatch, Third Party Advisory
https://huntr.dev/bounties/fcb65f2d-257a-46f4-bac9-f6ded5649079Exploit, Patch, Third Party Advisory

Timeline

Published: Nov 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391508.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391518.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391528.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391538.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391548.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391557.5Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce p CVE-2021-391567.5Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce p CVE-2021-391577.5detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data mat CVE-2021-391588.8NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository CVE-2021-391599.8BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositor CVE-2021-39166.5bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2021-391608.8nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously c