Security Release

• Update Instructions
• Update details on blog

BookStack v25.12.9 has been released.

This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.

We advise that you update your instance if you allow untrusted users to create or edit pages.

Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.

Full List of Changes

• Updated page revision diffs to use content filtering.
• Updated preference change redirect with stronger origin checks.
• Updated application PHP dependencies.

• [p]The Dead Hand Collection is now available, featuring 17 finishes from community contributors, and including 22 all-new gloves as rare special items.[/p][/*]
• [p]Access items in the Dead Hand Collection via the Dead Hand Terminal, available as a weekly drop.[/p][/*]

• [p]Fixed a pixel gap in a door Outside Long. [/p][/*]

• [p]Updated to the latest version from the Community Workshop (Update Notes)[/p][/*]

• View downloads

• View downloads