# BookStack v26.03.4 — BookStack v26.03.4

- Product: BookStack (https://whatsnew.fyi/product/bookstack)
- Vendor: Dan Brown
- Date: 2026-04-30
- Version: v26.03.4
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.4
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Improved attachment related permission checks to align page access checks
- **security** — Updated URL validation in webhooks to help prevent escaping workarounds
- **fixed** — Fixed issue where exact search term negation would lead to no results

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-4/)

This is a security release to improve attachment related permission checks, and URL validation for webhooks.

Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the `ALLOWED_SSR_HOSTS` BookStack env file option.

Thanks to 404_pkj ([GitHub](https://github.com/404-pkj)) and naruhodoowl ([GitHub](https://github.com/kilhsrito-crypto)) for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated attachment actions to align page access check.
* Updated URL validation in webhooks to help prevent escaping workarounds.
* Fixed issue where exact search term negation would lead to no results. ([#6121](https://codeberg.org/bookstack/bookstack/issues/6121))