BookStack v26.09.2

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.