This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
This release contains the following fixes and changes:
BookStack v25.12.4 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
Log in
ALLOW_CONTENT_SCRIPTS env option is now considered deprecated. It's advised to use the APP_CONTENT_FILTERING option, as documented here, instead if needed.If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of jhf which should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
This release contains the following fixes and changes:
BookStack v25.12.1 has been released.
This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
BookStack v25.11.6 has been released.
This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.
It's strongly advised to update if you're using SAML authentication for BookStack.
This release contains the following fixes and changes:
Note: This was originally accidentally published as v24.11.4, so this is essential a re-publish with the correct version.
The wrong version number commit/history has been retained though to prevent any breakages for git-managed environments.
This release contains the following fixes and changes:
Release v24.11.4
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
This release contains the following fixes and changes:
download-vendor command.
public/ folder within an active theme folder will now be exposed for public access. If for some reason you already have such a folder that you don't want exposed, rename it before upgrading.
This release contains the following fixes and changes:
This release contains the following fixes and changes:
