LoginSign Up
← Back to all sparks
B

BookStack

COLLAB
Velocity2.5

Self-hosted documentation/wiki platform with WYSIWYG editing.

www.bookstackapp.com ↗

BookStack's first feature release since May requires an APP_KEY and needed two quick patches

self-hostedsecuritydocumentationpermissionsopen-sourceui-customization
◆Current state
After four months of security patches on the 26.05 line, BookStack shipped v26.09 in late September: an interface layout system with theme support, API search within a book or chapter, a page scroll indicator, changelog messages on page API writes, and password changes that require the current password. It also stopped falling back to a default APP_KEY. Two patches followed within a month, one checking ZIP imports' real uncompressed size and one fixing comment and attachment exposure around the recycle bin and drafts.
◆Where it's heading
Security hardening keeps setting the cadence even after a feature release, with researcher reports credited in most patches. The new layout system opens the UI to customization through the theme system.
◆Prediction
Further 26.09.x security releases are likely given the steady run of researcher reports; the entries give no date for the next feature release.

◆Recent moves

  1. 20d ago

    BookStack 26.09.2 closes recycle-bin and draft attachment leaks

    Fixes comments of recycle-binned pages showing through the API and draft attachments editable by others, and drops remember-me cookies on password change. The second patch to v26.09 within a month.

    View source ↗
  2. 1mo ago

    BookStack 26.09.1 checks real ZIP size and fixes chapter permissions

    ZIP imports are now checked against their actual uncompressed size before extraction, and chapter-to-book promotion regenerates permissions. Hardening that follows a reported import issue.

    View source ↗
  3. 1mo ago

    BookStack 26.09 adds a UI layout system and scoped search API

    The feature release after four months of patches: a UI layout system, scoped search in the API, a reading progress bar, and a required APP_KEY that can break upgrades where it was never set.

    View source ↗
  4. 1mo ago

    BookStack 26.05.5 fixes social login account mismatches

    Social login lookups are now scoped to their provider, preventing accounts from different services being matched. A fix for instances that ever enabled more than one social login.

    View source ↗
  5. 2mo ago

    Security release closes a ZIP-import RCE and permission bypasses

    Six vulnerabilities closed, the most serious a remote-code-execution path through ZIP imports, alongside permission bypasses on attachments and draft pages. The strongest upgrade advice in this run of security releases.

    View source ↗
  6. 3mo ago

    Security release fixes five issues including auth matching

    Fixes external-auth user matching where OIDC, SAML2 or LDAP IDs differ only by casing or accents, plus a login-form timing oracle. Identity-boundary bugs, which is where a self-hosted wiki can least afford them.

    View source ↗