LoginSign Up
← Back to all sparks
B

BookStack

COLLAB
Velocity5.0

Self-hosted documentation/wiki platform with WYSIWYG editing.

www.bookstackapp.com ↗

BookStack's release log is now mostly security patches between feature drops.

self-hostedwikisecurity-patchespermissionsdocumentation
◆Current state
BookStack ships a feature release roughly every four months and fills the gaps with point releases that are almost all security fixes. The latest feature release, v26.09, added a customizable interface layout system and scoped search API endpoints; every point release since has closed permission and visibility holes.
◆Where it's heading
The recurring vulnerability theme is permission edge cases around drafts, the recycle bin and attachments, which suggests a steady external research effort probing the permission model. Feature work is leaning toward customization and API reach while the security cadence keeps the core trustworthy for self-hosters.
◆Prediction
Expect at least one more security point release before the next feature version, likely again touching drafts, attachments or recycle-bin permissions, since those areas recur in nearly every patch.

◆Recent moves

  1. 2d ago

    BookStack patches draft, image and recycle-bin permission leaks

    Another security release closing four permission gaps around draft pages, attachments and the recycle bin. It continues the pattern of researchers finding edge cases where content state and access rules drift apart.

    View source ↗
  2. 24d ago

    BookStack fixes comment and attachment exposure on drafts

    A narrow security patch for comments on deleted pages and attachments on drafts. Admins should update, but it does not change what the product does.

    View source ↗
  3. 1mo ago

    BookStack fixes ZIP import size check and audit log timezone

    A maintenance release with a ZIP import hardening fix, a permissions regeneration fix and translation updates. Routine cleanup two days after v26.09.

    View source ↗
  4. 1mo ago

    BookStack adds customizable UI layouts and scoped search API

    The one feature release in this window: a layout system that lets themes reshape the interface, plus API search within a book or chapter. It pushes BookStack toward being customizable and scriptable, and now hard-requires an APP_KEY.

    View source ↗
  5. 2mo ago

    BookStack fixes social login account mismatching

    A security fix scoping social login lookups so accounts from different providers can't be crossed. Important for instances that used multiple social logins, invisible otherwise.

    View source ↗
  6. 2mo ago

    BookStack patches ZIP import code execution and XSS issues

    The most serious patch in the run, including a ZIP import remote-code-execution path and drawing-endpoint XSS. It is still a fix release, but it raised the urgency of the security cadence that followed.

    View source ↗