# BookStack v26.05.2 — BookStack v26.05.2

- Product: BookStack (https://whatsnew.fyi/product/bookstack)
- Vendor: Dan Brown
- Date: 2026-07-02
- Version: v26.05.2
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.2
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.05.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Updated content allow-filtering to consider protocols used in srcset attributes
- **security** — Updated URL filtering with a more thorough centralized utility class
- **security** — Updated comment delete action to also check comment visibility permissions
- **security** — Updated referring URL use with stronger source validation
- **added** — Added Serbian language to language_select array
- **changed** — Updated PHP package versions
- **changed** — Updated translations with the latest crowdin changes

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-05-2/)

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol ([LinkedIn](https://www.linkedin.com/in/gurmandeep-deol/)) and MFK25 for responsibly reporting issues addressed in this release.

###### Full List of Changes

* Added Serbian language to language_select array. Thanks to [@PolarniMeda](https://codeberg.org/bookstack/bookstack/pulls/6153). ([#6153](https://codeberg.org/bookstack/bookstack/pulls/6153))
* Updated PHP package versions.
* Updated translations with the latest crowdin changes.
* Updated content allow-filtering to consider protocols used in srcset attributes.
* Updated URL filtering with a more thorough centralized utility class.
* Updated comment delete action to also check comment visibility permissions.
* Updated referring URL use with stronger source validation.
* Updated translations with latest crowdin changes. ([#6166](https://codeberg.org/bookstack/bookstack/pulls/6166))