Security Release Update Instructions Update details on blog This is a security release to address the following vulnerabilities: Comments of deleted pages could remain visible to API users while the page remained in the recycle bin. Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status. This update also includes…
Security Release Update Instructions Update details on blog This is a security release to address a range of vulnerabilities: External Authentication Use (OIDC/SAML2/LDAP) could potentially mismatch external authentication system users to BookStack users upon login, where unique IDs are very similar (same ID text but different casing, or accented characters). The login form could be abused to use…
Links Update instructions Full List of Changes This release contains the following fixes and changes: Updated audit log to use the configured display timezone. Thanks to @assyrus-favolo. (#6170) Updated translations with latest changes from Crowdin. (#6229) Updated ZIP import handling to verify the actual uncompressed size before extraction. Updated PHP package versions. Fixed page permissions not…
Links Release video overview Update instructions Update details on blog Upgrade Notices Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here. Full List of Changes Added interface…
Security Release Update Instructions Update details on blog This is a security release which addresses a vulnerability related to social login accounts, to prevent accounts from different services being potentially mis-matched. Upgrading is strongly advised if the instance has ever used more than one third-party/social login option (including previously used options which are no longer active). Th…
Security Release Update Instructions Update details on blog This is a security release to address a range of vulnerabilities: Users could update attachments on pages they did not have permission to update. Request endpoints for drawings could be misused to create cross-site-scripting scenarios. Draft page endpoints could be misused to alter non-draft pages without needing edit permission for those…
Security Release Update Instructions Update details on blog This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited. Upgrading is advised for instances with public access enabled, or for instances where untruste…
Security Release Update Instructions Update details on blog This is a security release to address the following vulnerabilities: Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view. The file:// protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information w…
Links Release video overview Update instructions Update details on blog Upgrade Notices Folder Permissions - Due to some changes in how fonts are used for exports, after updating you may need to ensure that the storage/fonts folder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. See this pag…
Security Release Update Instructions Update details on blog This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those. Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer o…
Security Release Update Instructions Update details on blog This is a security release to improve attachment related permission checks, and URL validation for webhooks. Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the ALLOWED_SSR_HOSTS BookStack env file option. Thanks to 404_pkj (GitH…
Links Update instructions Full List of Changes This release contains the following fixes and changes: Updated translations with latest Crowdin changes. (#6067) Updated PHP dependency versions.
Security Release Update Instructions Update details on blog This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles. Upgrade is very strongly advised if your instance has user registration enabled. Thanks to Kwonyong Lee (LinkedIn) for responsibly reporting this issue. Also thanks to Boustani OSAMA (LinkedIn) for als…
Security Release Update Instructions Update details on blog This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports. We strongly advise that you update your instance if you use permissions to control page visibility. Thanks to Ghufran Raza Khan (GitHub Profile, LinkedIn Profile) for responsibl…
Links Release video overview Update instructions Update details on blog Upgrade Notices Email/SMTP - The way BookStack sends messages has changed slightly (Specifically, the SMTP HELO domain). This isn't expected to be a breaking change but testing of emails (Using the test send action in Settings > Maintenance) is advised after updating to be sure there's no impact. Theme System - Within a theme…
Security Release Update Instructions Update details on blog BookStack v25.12.9 has been released. This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors. We advise that you update your instance if you…
Links Update instructions Full List of Changes This release contains the following fixes and changes: Fixed content filtering removing link target attribute, which would impact "New Window" links. (#6034) Fixed content filtering to not remove user references in comments. Updated PHP package versions.