LoginSign Up
← Back to all sparks
B

BookStack

COLLAB
Velocity5.0

Self-hosted documentation/wiki platform with WYSIWYG editing.

www.bookstackapp.com ↗

Five security releases in four months, this one closing an import RCE

self-hostedsecuritypermissionsdocumentationopen-source
◆Current state
BookStack's release stream since v26.05 has been almost entirely security patches. This release fixes a range of issues: attachments updatable without permission, XSS through the drawing endpoints, draft endpoints altering non-draft pages, other users' drafts leaking into search results, remote code execution through crafted ZIP imports, and page visibility not updating in recycle-bin scenarios. The feature release it patches, v26.05, added a page contents view, tag API and separately controlled revision permissions.
◆Where it's heading
The pattern is a substantial feature release followed by a run of point releases that are purely security, each crediting outside reporters. That cadence suggests sustained external scrutiny of the permission and import paths rather than a project shipping features in small increments. Every advisory in this run touches either permission checking or content handling on import and export — the two places where a self-hosted wiki with untrusted editors is most exposed.
◆Prediction
Nothing in this stream points to the next feature release; on the current pattern the next tag is more likely to be another point release closing reported issues in the same permission and import surfaces.

◆Recent moves

  1. 23d ago

    Security release closes a ZIP-import RCE and permission bypasses

    Six vulnerabilities closed, the most serious a remote-code-execution path through ZIP imports, alongside permission bypasses on attachments and draft pages. The strongest upgrade advice in this run of security releases.

    View source ↗
  2. 1mo ago

    Security release fixes five issues including auth matching

    Fixes external-auth user matching where OIDC, SAML2 or LDAP IDs differ only by casing or accents, plus a login-form timing oracle. Identity-boundary bugs, which is where a self-hosted wiki can least afford them.

    View source ↗
  3. 2mo ago

    URL filtering, redirects and permission checks hardened

    Edge cases in URL filtering, redirect handling and permission checking, with dependency updates alongside. Aimed at instances with public access or untrusted editors, the recurring theme of this series.

    View source ↗
  4. 3mo ago

    Attachment metadata leak and file:// export risk closed

    Closes an attachment metadata leak and a Windows-specific file:// export risk that could auto-run requests carrying credentials. Export handling joins permissions as a repeatedly patched surface.

    View source ↗
  5. 3mo ago

    v26.05 adds page contents view, tag API and revision permissions

    The feature release this whole patch run descends from: a page contents view, a tag API, and revision access controlled separately from page access. The revision change is a breaking one for existing roles.

    View source ↗
  6. 3mo ago

    Rate limiting added to MFA verification routes

    Rate limiting added to the MFA verification routes. A narrow hardening fix on the previous release line.

    View source ↗