BookStack Security Release v24.05.1

BookStack v24.05.1 has been released. This is a security release that adds extra rate-limiting to some forms that are accessible without authentication, while also implementing changes to prevent methods that could be used to indicate if specific user emails exist in the system.

Upgrade is advised for instances accessible on the public web.

Full List of Changes

  • Updated PHP dependencies.
  • Updated routes with IP-based rate limiting. (#4993)
  • Updated email confirmation flow to not require email submission form.
  • Updated translations with latest Crowdin changes. (#4994)
  • Updated WYSIWYG alignment handling to also consider table align attributes. (#5011)
  • Fixed attachment upload validation errors appearing as JSON. (#4996)
  • Fixed incorrect notification preferences URL in email. Thanks to @KiDxS. (#5008, #5005)
  • Fixed non-visible MFA setup titles in dark mode. (#5018)
  • Fixed outdated path in visual theme system guidance. (#4998)
  • Fixed potential cache permission issues by reverting cache location. (#4999)

For More Information

If you have any questions or comments about this advisory:


Header Image Credits: Photo by Dietmar Rabich (CC-BY-SA 4.0) - Image Modified