BookStack Security Release v26.09.3
Dan Brown posted on the 11th of November 2026
BookStack v26.09.3 has been released.
This is a security release to address a range of vulnerabilities:
- Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
- Page editor personal draft content could be made visible to other users in certain scenarios.
- On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
- Attachment endpoints could indicate existence of non-accessible pages.
Updating is advised if any of the above scenarios are a concern to your use-case.
A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:
- CayCon (Reporter), VulnCheck (Coordinator)
- Tanna Zu (GitHub)
- Dickson Wu (SEAL & CertiK)
- Zeng Yu
- Efe Çam
- dracaryxxd
Full List of Changes
- Updated application PHP package versions
- Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
- Updated image fetching to fully check access via page access, considering draft and trashed status.
- Updated revision diffing to filter on revision type.
- Updated chapter/book conversion to properly handle child items which are in the recycle bin.
For More Information
You can find update instructions here.
If you have any questions or comments about this advisory:
- Ask in the BookStack Community.
- Open an issue in the BookStack Codeberg repository.
- Follow the BookStack security policy to contact someone privately.
Header Image Credits: Photo by Acabashi (cc-by-sa-4) - Image Modified
