# BookStack v26.03.1 — BookStack v26.03.1

- Product: BookStack (https://whatsnew.fyi/product/bookstack)
- Vendor: Dan Brown
- Date: 2026-03-17
- Version: v26.03.1
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix vulnerability where page content hidden by permissions could be visible during certain markdown exports
- **changed** — Updated queries used for pages in markdown exports
- **changed** — Updated handling of filenames for file serving
- **changed** — Updated PHP package versions

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-1/)

This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports. 

We strongly advise that you update your instance if you use permissions to control page visibility.

Thanks to Ghufran Raza Khan ([GitHub Profile](https://github.com/Ghufran2), [LinkedIn Profile](https://www.linkedin.com/in/ghufrankhan0000)) for responsibly reporting this issue.
Also thanks to Alex Dan ([GitHub Profile](https://github.com/windbreaker555)) for also reporting this before public announcement. 

###### Full List of Changes

* Updated queries used for pages in markdown exports.
* Updated handling of filenames for file serving.
* Updated PHP package versions.