LoginSign Up
← Back to all sparks
B

BookStack

COLLAB
Velocity5.0

Self-hosted documentation/wiki platform with WYSIWYG editing.

www.bookstackapp.com ↗

BookStack's release stream is mostly security patches with feature drops in between.

self-hostedsecurity-releasespermissionsdocumentationphp
◆Current state
Four of BookStack's last six releases are security releases. The newest closes five separate issues at once: external authentication could match the wrong user where IDs differ only by casing or accents, the login form leaked user existence through timing, exported content could load interactive content over file links, API errors exposed debug detail by default, and the default PDF renderer could probe files on the host. The one feature release, v26.05, added a page contents view in the editor, tag browsing API endpoints, a dedicated revision-viewing permission, in-UI MFA reset and new image and CSP controls.
◆Where it's heading
Cadence is set by responsible disclosures — a named researcher credited in nearly every patch — and the feature work leans the same way, toward finer permissions and content security controls. For a self-hosted wiki that users routinely expose publicly, hardening is the roadmap, with quarterly feature releases sitting between patch runs.
◆Prediction
Expect another patch on the 26.05 line next. The permission and CSP work visible in v26.05 is the thread the following minor most plausibly continues, though the entries give no signal on timing.

◆Recent moves

  1. 13d ago

    Security release fixes five issues including auth matching

    The widest patch in the window, closing five issues including external auth IDs matching the wrong user across casing or accents, login timing that leaked user existence, and PDF rendering that could check for files on the host. Instances on OIDC, SAML2 or LDAP should take it first.

    View source ↗
  2. 1mo ago

    URL filtering, redirects and permission checks hardened

    Edge-case fixes across URL filtering, redirect handling and comment visibility permissions, with dependency updates alongside. Aimed at instances with public access or untrusted editors.

    View source ↗
  3. 2mo ago

    Attachment metadata leak and file:// export risk closed

    Attachment requests could leak metadata for files a user could not view, and file:// links in exports could auto-run with credential information on Windows. Both sit on the export-and-permissions surface this project keeps returning to.

    View source ↗
  4. 2mo ago

    v26.05 adds page contents view, tag API and revision permissions

    The only feature release here, and its additions follow the same instinct as the patches: a separate permission for viewing revisions, new image and CSP controls, and in-UI MFA reset, alongside a page contents view and tag browsing endpoints. Note the upgrade caveats on font folder permissions and revision access.

    View source ↗
  5. 2mo ago

    Rate limiting added to MFA verification routes

    Rate limiting on multi-factor verification routes to blunt brute-force attempts, plus library updates. Narrow, and worth taking where MFA is load-bearing.

    View source ↗
  6. 3mo ago

    Attachment permission and webhook URL validation fixes

    Attachment deletion now aligns with page access checks, and webhook URL validation is tightened against workarounds that escape the allowed-host list. A small patch on the previous release line.

    View source ↗