BookStack

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
• Page editor personal draft content could be made visible to other users in certain scenarios.
• On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
• Attachment endpoints could indicate existence of non-accessible pages.

Updating is advised if any of the above scenarios are a concern to your use-case.

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• CayCon (Reporter), VulnCheck (Coordinator)
• Tanna Zu (GitHub)
• Dickson Wu (SEAL & CertiK)
• Zeng Yu
• Efe Çam
• dracaryxxd

Full List of Changes

• Updated application PHP package versions
• Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
• Updated image fetching to fully check access via page access, considering draft and trashed status.
• Updated revision diffing to filter on revision type.
• Updated chapter/book conversion to properly handle child items which are in the recycle bin.