BookStack
BookStack
A platform for storing and organising information and documentation.
26.05.4
- Release date
- August 24, 2026
- Security status
- 2 high-severity CVEs tracked in the last 90 days. Current version not affected.
Source
GitHub API
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 26.05.4 | 2026-08-24 | Release Notes |
| 26.05.3 | 2026-07-29 | Release Notes |
| 26.05.2 | 2026-07-02 | Release Notes |
| 26.05.1 | 2026-06-09 | Release Notes |
| 26.05 | 2026-05-28 | Release Notes |
| 26.03.5 | 2026-05-21 | Release Notes |
| 26.03.4 | 2026-04-30 | Release Notes |
| 26.03.3 | 2026-04-05 | Release Notes |
| 26.03.2 | 2026-03-23 | Release Notes |
| 26.03.1 | 2026-03-17 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-84695 | CRITICAL (9.3) | 2026-09-02 | Current versionnot affected | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers. Affected versions
|
| CVE-2026-82450 | HIGH (8.7) | 2026-08-29 | Current versionnot affected | BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. Affected versions
|