BookStack vs Zoho Sign

BookStack is in a heavy security-patching phase on the 26.03 line, with five point releases since mid-March covering MFA brute-force, attachment permissions, webhook URL validation, registration role escalation, and hidden-page leakage. Every fix names the external researcher who reported it. Outside the security train, the v26.03 minor itself was the last meaningful feature release, shipping a theme-module reorganization and SMTP HELO change.

Expect the patch cadence to slow as the surfaced classes of vulnerabilities (auth, permissions, content filtering) stabilize, with the next minor likely concentrating on the theme-module API now that 26.03 has established the modules/ directory convention. The project's responsible-disclosure pipeline appears active and productive — multiple researchers, public credit, clear advisories — which is itself a competitive signal in the self-hosted wiki space.

A 26.03.6 within four weeks is likely given the current cadence, probably another dependency-bump rollup. The next minor (26.06 or 26.09 depending on the release calendar) will probably formalize the theme-modules surface and start adding API documentation for it.