# BookStack v26.05.1 — BookStack v26.05.1

- Product: BookStack (https://whatsnew.fyi/product/bookstack)
- Vendor: Dan Brown
- Date: 2026-06-09
- Version: v26.05.1
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.1
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed attachment requests that could be manipulated to leak details, links, and metadata of attachments which the user did not have permission to view
- **security** — Filtered the file:// protocol from interactive content to prevent abuse in Windows-specific scenarios for auto-running requests with credential information when viewing exports
- **security** — Fixed search system abuse that could cause errors and fill logs
- **changed** — Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content
- **changed** — Updated attachment update handling to validate permissions before request content
- **fixed** — Fixed numeric handling issue in tag search when using non-standard numbers

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05-1/)

This is a security release to address the following vulnerabilities:

- Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view.
- The `file://` protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.
  - This protocol is now filtered from interactive content.
- The search system could be abused to cause errors and fill logs.

Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.

Thanks to Stephen O. / Sakusen ([Codeberg](https://codeberg.org/Sakusen), [Website](https://sakusen.dev/)), Gurmandeep Deol ([LinkedIn](https://www.linkedin.com/in/gurmandeep-deol/)), Rafael Castilho ([X account](https://x.com/castilho101)) and Gabriel Duarte Guerra ([GitHub](https://github.com/GabriWar)) for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated translations with the latest Crowdin changes.
* Updated content allow-filtering to only allow the `file://` protocol on anchor hrefs, instead of in all dynamic content.
* Updated attachment update handling to validate permissions before request content.
* Fixed numeric handling issue in tag search when using non-standard numbers.