BookStack Security Release v21.08.5

BookStack v21.08.5 has been released. This is a security release that covers a vulnerability which would allow malicious users, who have permission to update or create pages, to load content from files stored within the storage/ or public/ directories (Such as application logs) via the page HTML export system.

If you allow untrusted users to edit page content you should update as soon as possible.

This release also changes the way browser response caching is performed, while logged in, to help prevent navigating back to confidential content after logout.

Additional Changes

  • Added concurrent page editing warnings upon draft save events. Thanks to @MatthieuParis (#2877)
  • Updated translations with the latest changes from Crowdin. (#2953)

For more information

If you have any questions or comments about this advisory:

Header Image Credits: Photo by Georg Bommeli on Unsplash