BookStack Security Release v25.12.3

Dan Brown Dan Brown posted on the 29th of January 2026

BookStack v25.12.3 has been released.

This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.

We strongly advise that you update your instance if you allow untrusted users to create or edit pages.

Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.

Additional Update Notices

  • Page Content - As of this release, most types of form content are now removed from page content on render. If you applied customizations which made use of in-page form content, you may now need to find alternative methods.

Full List of Changes

  • Updated application PHP dependencies.
  • Updated session-based API authentication to only be active for GET requests.
  • Updated page content filtering to remove many common form elements & attributes.
  • Updated translations with latest Crowdin changes. (#5997)

For More Information

You can find update instructions here.
If you have any questions or comments about this advisory:

Header Image Credits: Photo by Dominic Nelson (CC-BY-SA 4.0) - Image Modified

Want to let me know what you think of BookStack or this post?
You can find me on Mastodon @danb@fosstodon.org or on the BookStack Discord server.

Subscribe to Updates

There are two lists you can sign-up to for updates, A general news & updates list, sent on a weekly basis, and a security alerts list that's sent when new security updates are available.

News and Updates | Security Alerts