# BookStack changelog

> A simple, self-hosted platform for organising and storing documentation.

- Vendor: Dan Brown
- Category: Productivity
- Official site: https://www.bookstackapp.com
- Tracked by: What's New (https://whatsnew.fyi/product/bookstack)
- Harvested from: GitHub (BookStackApp/BookStack)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v26.05.3 — BookStack v26.05.3

- Date: 2026-07-29
- Version: v26.05.3
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.3
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05.3

- **security** — Fixed external authentication (OIDC/SAML2/LDAP) user mismatch on login caused by case-insensitive or accented character differences in unique IDs
- **security** — Added fake hash and random delay on failed login to prevent timing-based user existence enumeration
- **security** — Updated allow list content filter to force the use of schemes and prevent interactive content from loading over file links in exports
- **security** — Updated API exception handler to follow a more controlled error message approach and prevent exposure of debug details
- **security** — Updated allow list content filter with smarter srcset attribute parsing to prevent file access beyond intended scope in PDF rendering
- **changed** — Updated user external authentication ID queries and database column collation to ensure exact match
- **changed** — Updated PHP package versions
- **changed** — Updated translations with the latest Crowdin changes
- **fixed** — Fixed image delete API endpoint to avoid an error scenario

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05-3/)

This is a security release to address a range of vulnerabilities:

- External Authentication Use (OIDC/SAML2/LDAP) could potentially mismatch external authentication system users to BookStack users upon login, where unique IDs are very similar (same ID text but different casing, or accented characters).
- The login form could be abused to use timing to gain information about if a user exists in the system. This was already limited by request rate-limits, but could still have assisted targeted scenarios.
- Certain editor content could be used to load interactive content over file links when exported, which could then pose a risk after being exported in Windows environments which use NTLM.
- API errors could include debug details by default, and therefore potentially expose some system details like file paths.
- With our default PDF rendering option, certain content could be used to access/check for files on the BookStack host beyond the scope of what we'd expect.

Upgrading is generally advised, but more so for instances using OIDC, SAML2 or LDAP authentication.

Thanks to Tanner Marks ([GitHub](https://github.com/TannerMar)), Gurmandeep Deol ([LinkedIn](https://www.linkedin.com/in/gurmandeep-deol/)) and whale120 ([Blog](https://blog.whale-tw.com/), [X](https://x.com/whale120_tw), Working with DEVCORE Internship Program) for responsibly reporting issues addressed in this release.

###### Full List of Changes

* Updated PHP package versions.
* Updated translations with the latest Crowdin changes.
* Updated login with fake hash and random delay on failed login.
* Updated allow list content filter to force the use of schemes.
* Updated allow list content filter with smarter srcset attribute parsing.
* Updated user external authentication ID queries, and database column collation, to ensure an exact match.
* Updated API exception handler to follow a more controlled error message approach.
* Fixed image delete API endpoint to avoid an error scenario.

### v26.05.2 — BookStack v26.05.2

- Date: 2026-07-02
- Version: v26.05.2
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.2
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05.2

- **security** — Updated content allow-filtering to consider protocols used in srcset attributes
- **security** — Updated URL filtering with a more thorough centralized utility class
- **security** — Updated comment delete action to also check comment visibility permissions
- **security** — Updated referring URL use with stronger source validation
- **added** — Added Serbian language to language_select array
- **changed** — Updated PHP package versions
- **changed** — Updated translations with the latest crowdin changes

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05-2/)

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol ([LinkedIn](https://www.linkedin.com/in/gurmandeep-deol/)) and MFK25 for responsibly reporting issues addressed in this release.

###### Full List of Changes

* Added Serbian language to language_select array. Thanks to [@PolarniMeda](https://codeberg.org/bookstack/bookstack/pulls/6153). ([#6153](https://codeberg.org/bookstack/bookstack/pulls/6153))
* Updated PHP package versions.
* Updated translations with the latest crowdin changes.
* Updated content allow-filtering to consider protocols used in srcset attributes.
* Updated URL filtering with a more thorough centralized utility class.
* Updated comment delete action to also check comment visibility permissions.
* Updated referring URL use with stronger source validation.
* Updated translations with latest crowdin changes. ([#6166](https://codeberg.org/bookstack/bookstack/pulls/6166))

### v26.05.1 — BookStack v26.05.1

- Date: 2026-06-09
- Version: v26.05.1
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.1
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05.1

- **security** — Fixed attachment requests that could be manipulated to leak details, links, and metadata of attachments which the user did not have permission to view
- **security** — Filtered the file:// protocol from interactive content to prevent abuse in Windows-specific scenarios for auto-running requests with credential information when viewing exports
- **security** — Fixed search system abuse that could cause errors and fill logs
- **changed** — Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content
- **changed** — Updated attachment update handling to validate permissions before request content
- **fixed** — Fixed numeric handling issue in tag search when using non-standard numbers

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05-1/)

This is a security release to address the following vulnerabilities:

- Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view.
- The `file://` protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.
  - This protocol is now filtered from interactive content.
- The search system could be abused to cause errors and fill logs.

Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.

Thanks to Stephen O. / Sakusen ([Codeberg](https://codeberg.org/Sakusen), [Website](https://sakusen.dev/)), Gurmandeep Deol ([LinkedIn](https://www.linkedin.com/in/gurmandeep-deol/)), Rafael Castilho ([X account](https://x.com/castilho101)) and Gabriel Duarte Guerra ([GitHub](https://github.com/GabriWar)) for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated translations with the latest Crowdin changes.
* Updated content allow-filtering to only allow the `file://` protocol on anchor hrefs, instead of in all dynamic content.
* Updated attachment update handling to validate permissions before request content.
* Fixed numeric handling issue in tag search when using non-standard numbers.

### v26.05 — BookStack v26.05

- Date: 2026-05-28
- Version: v26.05
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05

- **added** — Add page contents view to page editor
- **added** — Add API endpoints for browsing tags
- **added** — Add custom font load handling for default PDF renderer
- **added** — Add in-UI option to reset user multi-factor authentication methods
- **added** — Add hints to sort rule selection alongside empty lists
- **added** — Add specific permission for revision viewing
- **added** — Add new image and CSS CSP controls
- **added** — Add Thai language support
- **changed** — Update codebase to meet PHPStan Level 4
- **changed** — Update comment/description WYSIWYG editor to support inline code
- **changed** — Update HTML to plain text conversion handling
- **changed** — Update image upload handling to validate referenced page
- **changed** — Update JavaScript packages
- **changed** — Update module install command with usability improvements
- **changed** — Update new WYSIWYG editor with a range of fixes
- **changed** — Update translations with latest Crowdin changes
- **fixed** — Fix misaligned link attachment validation rules
- **fixed** — Fix non-ascii character issues in headers on PDF exports

###### Links

- [Release video overview](https://foss.video/w/gy87ixrPn61DpWGWbCVTp7)
- [Update instructions](https://www.bookstackapp.com/docs/admin/updates)
- [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05/)

###### Upgrade Notices

- **Folder Permissions** - Due to some changes in how fonts are used for exports, after updating you may need to ensure that the `storage/fonts` folder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. [See this page](https://www.bookstackapp.com/docs/admin/filesystem-permissions/) for guidance on setting permissions.
- **Revision Access** - Revision access & visibility is now controlled separately to pages. In some cases, after upgrading, users may no longer be able to access revisions by default (for example, where users had access to view page content but had no role-level view permissions).

###### Full List of Changes

* Added page contents view to page editor. ([#6131](https://codeberg.org/bookstack/bookstack/pulls/6131), [#4218](https://codeberg.org/bookstack/bookstack/issues/4218))
* Added API endpoints for browsing tags. ([#6095](https://codeberg.org/bookstack/bookstack/pulls/6095), [#5835](https://codeberg.org/bookstack/bookstack/issues/5835))
* Added custom font load handling for default PDF renderer. ([#6109](https://codeberg.org/bookstack/bookstack/pulls/6109), [#148](https://codeberg.org/bookstack/bookstack/issues/148), [#719](https://codeberg.org/bookstack/bookstack/issues/719), [#5770](https://codeberg.org/bookstack/bookstack/issues/5770))
* Added in-UI option to reset user multi-factor authentication methods. Thanks to [@clauvaldez](https://codeberg.org/bookstack/bookstack/pulls/6056). ([#6056](https://codeberg.org/bookstack/bookstack/pulls/6056))
* Added hints to sort rule selection alongside empty lists. ([#5967](https://codeberg.org/bookstack/bookstack/issues/5967))
* Added specific permission for revision viewing. ([#6108](https://codeberg.org/bookstack/bookstack/pulls/6108), [#4526](https://codeberg.org/bookstack/bookstack/issues/4526))
* Added new image and CSS CSP controls. Thanks to [@Zhey-on](https://codeberg.org/bookstack/bookstack/pulls/6071). ([#6071](https://codeberg.org/bookstack/bookstack/pulls/6071), [#6033](https://codeberg.org/bookstack/bookstack/issues/6033))
* Added Thai language support. ([#6105](https://codeberg.org/bookstack/bookstack/issues/6105))
* Updated codebase to meet PHPStan Level 4. ([#6085](https://codeberg.org/bookstack/bookstack/pulls/6085))
* Updated comment/description WYSIWYG editor to support inline code. ([#6100](https://codeberg.org/bookstack/bookstack/pulls/6100), [#6003](https://codeberg.org/bookstack/bookstack/issues/6003))
* Updated HTML to plain text conversion handling. ([#6083](https://codeberg.org/bookstack/bookstack/pulls/6083))
* Updated image upload handling to validate referenced page. ([#6126](https://codeberg.org/bookstack/bookstack/issues/6126))
* Updated JavaScript packages. ([#6090](https://codeberg.org/bookstack/bookstack/pulls/6090))
* Updated module install command with usability improvements. ([#6094](https://codeberg.org/bookstack/bookstack/pulls/6094), [#6066](https://codeberg.org/bookstack/bookstack/issues/6066))
* Updated new WYSIWYG editor with a range of fixes. ([#6119](https://codeberg.org/bookstack/bookstack/pulls/6119), [#5631](https://codeberg.org/bookstack/bookstack/issues/5631))
* Updated translations with latest Crowdin changes. ([#6084](https://codeberg.org/bookstack/bookstack/pulls/6084))
* Fixed misaligned link attachment validation rules. ([#6093](https://codeberg.org/bookstack/bookstack/issues/6093))
* Fixed non-ascii character issues in headers on PDF exports. Thanks to [@alexwoo-awso](https://codeberg.org/bookstack/bookstack/pulls/6069). ([#6069](https://codeberg.org/bookstack/bookstack/pulls/6069), [#6107](https://codeberg.org/b

_[Truncated at 4000 characters — full notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05]_

### v26.03.5 — BookStack v26.03.5

- Date: 2026-05-21
- Version: v26.03.5
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.5
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.5

- **security** — Address brute-force based vulnerability related to multi-factor authentication
- **security** — Update PHP package versions to help avoid potential vulnerabilities
- **changed** — Update MFA verification routes with rate limiting

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-5/)

This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those.

Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer of defense.

Thanks to Stephen O. / Sakusen ([Codeberg](https://codeberg.org/Sakusen), [Website](https://sakusen.dev/))  for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated MFA verification routes with rate limiting.

### v26.03.4 — BookStack v26.03.4

- Date: 2026-04-30
- Version: v26.03.4
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.4
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.4

- **security** — Improved attachment related permission checks to align page access checks
- **security** — Updated URL validation in webhooks to help prevent escaping workarounds
- **fixed** — Fixed issue where exact search term negation would lead to no results

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-4/)

This is a security release to improve attachment related permission checks, and URL validation for webhooks.

Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the `ALLOWED_SSR_HOSTS` BookStack env file option.

Thanks to 404_pkj ([GitHub](https://github.com/404-pkj)) and naruhodoowl ([GitHub](https://github.com/kilhsrito-crypto)) for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated attachment actions to align page access check.
* Updated URL validation in webhooks to help prevent escaping workarounds.
* Fixed issue where exact search term negation would lead to no results. ([#6121](https://codeberg.org/bookstack/bookstack/issues/6121))

### v26.03.3 — BookStack v26.03.3

- Date: 2026-04-05
- Version: v26.03.3
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.3
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.3

- **changed** — Updated translations with latest Crowdin changes
- **changed** — Updated PHP dependency versions

###### Links

- [Update instructions](https://www.bookstackapp.com/docs/admin/updates)

###### Full List of Changes

This release contains the following fixes and changes:

* Updated translations with latest Crowdin changes. ([#6067](https://github.com/BookStackApp/BookStack/pull/6067)) 
* Updated PHP dependency versions.

### v26.03.2 — BookStack v26.03.2

- Date: 2026-03-23
- Version: v26.03.2
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.2
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.2

- **security** — Fixed vulnerability where the registration form could be manipulated to gain access to additional roles
- **fixed** — Updated user creation to only use validated input from registration
- **changed** — Updated PHP package versions
- **changed** — Updated translations with latest Crowdin changes
- **changed** — Updated WYSIWYG editors to have consistent collapsible block double click behavior

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-2/)

This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles.

Upgrade is **very strongly** advised if your instance has user registration enabled.

Thanks to Kwonyong Lee ([LinkedIn](https://www.linkedin.com/in/kwonyong-lee-854bb0372)) for responsibly reporting this issue.
Also thanks to Boustani OSAMA ([LinkedIn](https://www.linkedin.com/in/boustani-osama-cy/)) for also reporting this before public announcement.

###### Full List of Changes

* Updated user creation to only use validated input from registration.
* Updated PHP package versions.
* Updated translations with latest Crowdin changes. ([#6064](https://github.com/BookStackApp/BookStack/pull/6064))
* Updated PHP_CodeSniffer repository link. Thanks to [@rodrigoprimo](https://github.com/BookStackApp/BookStack/pull/6060). ([#6060](https://github.com/BookStackApp/BookStack/pull/6060))
* Updated WYSIWYG editors to have consistent collapsible block double click behavior. ([#6059](https://github.com/BookStackApp/BookStack/issues/6059))

### v26.03.1 — BookStack v26.03.1

- Date: 2026-03-17
- Version: v26.03.1
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.1

- **security** — Fix vulnerability where page content hidden by permissions could be visible during certain markdown exports
- **changed** — Updated queries used for pages in markdown exports
- **changed** — Updated handling of filenames for file serving
- **changed** — Updated PHP package versions

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-1/)

This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports. 

We strongly advise that you update your instance if you use permissions to control page visibility.

Thanks to Ghufran Raza Khan ([GitHub Profile](https://github.com/Ghufran2), [LinkedIn Profile](https://www.linkedin.com/in/ghufrankhan0000)) for responsibly reporting this issue.
Also thanks to Alex Dan ([GitHub Profile](https://github.com/windbreaker555)) for also reporting this before public announcement. 

###### Full List of Changes

* Updated queries used for pages in markdown exports.
* Updated handling of filenames for file serving.
* Updated PHP package versions.

### v26.03 — BookStack v26.03

- Date: 2026-03-15
- Version: v26.03
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03

- **added** — Add new module system to the theme system
- **added** — Add logical theme events for page content render and pre-save
- **added** — Add logical theme event and class to allow inserting custom views before/after others
- **added** — Add logical theme event to allow customising the OIDC authentication URL
- **changed** — Update book delete to return to the parent shelf in a shelf context
- **changed** — Update book read API endpoint to provide parent shelf information
- **changed** — Update cursor to pointer for drawio diagrams
- **changed** — Update description for per-page display limits
- **changed** — Update emails to use the domain from the APP_URL in the SMTP HELO
- **changed** — Update translations with latest Crowdin changes
- **fixed** — Fix empty extra space showing for descriptions when the input is left empty

###### Links

- [Release video overview](https://foss.video/w/pb8WBgLhvoN78jVNrFR7Lk)
- [Update instructions](https://www.bookstackapp.com/docs/admin/updates)
- [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03/)

###### Upgrade Notices

- **Email/SMTP** - The way BookStack sends messages has changed slightly (Specifically, the SMTP HELO domain). This isn't expected to be a breaking change but testing of emails (Using the test send action in Settings > Maintenance) is advised after updating to be sure there's no impact.
- **Theme System** - Within a theme directory, the `modules/` folder is now dedicated to theme modules. If you happened to already have a folder of this name in your theme, it's advised to use a different folder name instead.

###### Full List of Changes

**Released in v26.03**

* Added new module system to the theme system. ([#5998](https://github.com/BookStackApp/BookStack/pull/5998))
* Added logical theme events for page content render and pre-save. ([#6049](https://github.com/BookStackApp/BookStack/issues/6049))
* Added logical theme event and class to allow inserting custom views before/after others. ([#5998](https://github.com/BookStackApp/BookStack/pull/5998))
* Added logical theme event to allow customising the OIDC authentication URL. ([#6014](https://github.com/BookStackApp/BookStack/issues/6014))
* Updated book delete to return to the parent shelf in a shelf context. ([#6029](https://github.com/BookStackApp/BookStack/issues/6029))
* Updated book read API endpoint to provide parent shelf information. ([#6006](https://github.com/BookStackApp/BookStack/issues/6006))
* Updated cursor to pointer for drawio diagrams. Thanks to [@lublak](https://github.com/BookStackApp/BookStack/pull/5864). ([#5864](https://github.com/BookStackApp/BookStack/pull/5864))
* Updated description for per-page display limits. ([#6005](https://github.com/BookStackApp/BookStack/issues/6005))
* Updated emails to use the domain from the APP_URL in the SMTP HELO. ([#5990](https://github.com/BookStackApp/BookStack/issues/5990))
* Updated translations with latest Crowdin changes. ([#6007](https://github.com/BookStackApp/BookStack/pull/6007))
* Fixed empty extra space showing for descriptions when the input is left empty. ([#5724](https://github.com/BookStackApp/BookStack/issues/5724))