GeezerVison

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
• Page editor personal draft content could be made visible to other users in certain scenarios.
• On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
• Attachment endpoints could indicate existence of non-accessible pages.

Updating is advised if any of the above scenarios are a concern to your use-case.

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• CayCon (Reporter), VulnCheck (Coordinator)
• Tanna Zu (GitHub)
• Dickson Wu (SEAL & CertiK)
• Zeng Yu
• Efe Çam
• dracaryxxd

Full List of Changes

• Updated application PHP package versions
• Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
• Updated image fetching to fully check access via page access, considering draft and trashed status.
• Updated revision diffing to filter on revision type.
• Updated chapter/book conversion to properly handle child items which are in the recycle bin.

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated audit log to use the configured display timezone. Thanks to @assyrus-favolo. (#6170)
• Updated translations with latest changes from Crowdin. (#6229)
• Updated ZIP import handling to verify the actual uncompressed size before extraction.
• Updated PHP package versions.
• Fixed page permissions not being regenerated on chapter promotion. (#6226)
• Fixed API attachment list endpoint showing attachments for pages in the recycle bin. (#6194)

Thanks to ma4ter (GitHub) for responsibly reporting the ZIP import scenario.

Links

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here.

Full List of Changes

• Added interface layout system for UI customization, with theme system support. (#6179)
• Added API endpoints for searching within a specific book or chapter. Thanks to @enableservices. (#6182)
• Added a page scroll progress indicator. (#6176, #5932)
• Added ability to easily download API docs as JSON or HTML. (#6198)
• Updated translations with the latest Crowdin changes. (#6225)
• Updated app logo with better accessibility text. (#6171)
• Updated codebase static analysis to PHPStan Level 5. (#6143, #6089)
• Updated config to remove default APP_KEY value. (#6210)
• Updated new WYSIWYG editor with a range of fixes and improvements. (#6207)
• Updated page create/update endpoints to allow a changelog message. (#6162)
• Updated user password changes to require their existing password. (#6181)
• Fixed incorrect LDAP group result handling scenario. (#6088)
• Fixed lack of label text connected to checkboxes for screen readers. Thanks to @MHameed. (#6173)
• Fixed markdown table alignment being removed by page content filtering. (#6167)
• Fixed page content popup being caught in text selection range. (#6214)
• Fixed unexpected error when using an invalid page ID with the API. (#6136)

Security Release

• Update Instructions
• Update details on blog

This is a security release which addresses a vulnerability related to social login accounts, to prevent accounts from different services being potentially mis-matched.

Upgrading is strongly advised if the instance has ever used more than one third-party/social login option (including previously used options which are no longer active).

Thanks to Google and Ada Logics for the discovery and responsible disclosure of this issue.

Full List of Changes

• Updated social logins to scope social account queries to social system.
• Updated PHP package versions.

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Users could update attachments on pages they did not have permission to update.
• Request endpoints for drawings could be misused to create cross-site-scripting scenarios.
• Draft page endpoints could be misused to alter non-draft pages without needing edit permission for those pages.
• Draft pages created by other users could appear in certain search result lists.
• ZIP imports with certain content could lead to a remote-code-execution scenario.
• Page visibility rules may not be updated in certain recycle-bin-related scenarios.

Updating is generally advised, but strongly so where untrusted users have general access to the instance.

If untrusted users do have access, especially edit level access, it's advised to double check image upload folders to ensure there's no unexpected non-image content.
On a typical Linux-based system installation, this could be done using the find command from the BookStack installation folder like so:

# Check the general "public" server space
find ./public/uploads -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" -o -iname ".gitignore" -o -iname ".htaccess" \)

# Check the internal image storage space
find ./storage/uploads/images -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" \)

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• ByteMe.Red (Website)
• Emanuele Cervelli (GitHub)
• SVO (Website)
• Ahmed Ibrahim (GitHub, Website)
• Submersion.ai Security Research Team (Website)

Full List of Changes

• Updated image serving with additional MIME-based content type check.
• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Fixed issue where anchor links would be removed or be made invalid. (#6178)
• Fixed issue where sftp links would be removed from content. (#6186)
• Fixed lack of content validation when storing base64 drawing content.
• Fixed lack of permission check on draft endpoints.
• Fixed lacking content validation checks on book covers during ZIP imports.
• Fixed missing update permission check on attachment API.
• Fixed scenario where joint permission table would not be updated for chapter pages which are in the recycle bin.
• Fixed search queries not filtering out drafts from other users.

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• External Authentication Use (OIDC/SAML2/LDAP) could potentially mismatch external authentication system users to BookStack users upon login, where unique IDs are very similar (same ID text but different casing, or accented characters).
• The login form could be abused to use timing to gain information about if a user exists in the system. This was already limited by request rate-limits, but could still have assisted targeted scenarios.
• Certain editor content could be used to load interactive content over file links when exported, which could then pose a risk after being exported in Windows environments which use NTLM.
• API errors could include debug details by default, and therefore potentially expose some system details like file paths.
• With our default PDF rendering option, certain content could be used to access/check for files on the BookStack host beyond the scope of what we'd expect.

Upgrading is generally advised, but more so for instances using OIDC, SAML2 or LDAP authentication.

Thanks to Tanner Marks (GitHub), Gurmandeep Deol (LinkedIn) and whale120 (Blog, X, Working with DEVCORE Internship Program) for responsibly reporting issues addressed in this release.

Additional Update Notices

• SAML2/OIDC/LDAP Auth - Due to stricter use of IDs in this release, to match users across BookStack and authentication platforms, it's possible that users with mis-matching values are no longer able to login. In these cases, ensure that the "External Authentication ID" for the user exactly matches the ID which would be coming from the authentication system.

Full List of Changes

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated login with fake hash and random delay on failed login.
• Updated allow list content filter to force the use of schemes.
• Updated allow list content filter with smarter srcset attribute parsing.
• Updated user external authentication ID queries, and database column collation, to ensure an exact match.
• Updated API exception handler to follow a more controlled error message approach.
• Fixed image delete API endpoint to avoid an error scenario.

Security Release

• Update Instructions
• Update details on blog

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol (LinkedIn) and MFK25 for responsibly reporting issues addressed in this release.

Full List of Changes

• Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
• Updated PHP package versions.
• Updated translations with the latest crowdin changes.
• Updated content allow-filtering to consider protocols used in srcset attributes.
• Updated URL filtering with a more thorough centralized utility class.
• Updated comment delete action to also check comment visibility permissions.
• Updated referring URL use with stronger source validation.
• Updated translations with latest crowdin changes. (#6166)

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view.
• The file:// protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.
  • This protocol is now filtered from interactive content.
• The search system could be abused to cause errors and fill logs.

Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.

Thanks to Stephen O. / Sakusen (Codeberg, Website), Gurmandeep Deol (LinkedIn), Rafael Castilho (X account) and Gabriel Duarte Guerra (GitHub) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content.
• Updated attachment update handling to validate permissions before request content.
• Fixed numeric handling issue in tag search when using non-standard numbers.

Links

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Folder Permissions - Due to some changes in how fonts are used for exports, after updating you may need to ensure that the storage/fonts folder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. See this page for guidance on setting permissions.
• Revision Access - Revision access & visibility is now controlled separately to pages. In some cases, after upgrading, users may no longer be able to access revisions by default (for example, where users had access to view page content but had no role-level view permissions).

Full List of Changes

• Added page contents view to page editor. (#6131, #4218)
• Added API endpoints for browsing tags. (#6095, #5835)
• Added custom font load handling for default PDF renderer. (#6109, #148, #719, #5770)
• Added in-UI option to reset user multi-factor authentication methods. Thanks to @clauvaldez. (#6056)
• Added hints to sort rule selection alongside empty lists. (#5967)
• Added specific permission for revision viewing. (#6108, #4526)
• Added new image and CSS CSP controls. Thanks to @Zhey-on. (#6071, #6033)
• Added Thai language support. (#6105)
• Updated codebase to meet PHPStan Level 4. (#6085)
• Updated comment/description WYSIWYG editor to support inline code. (#6100, #6003)
• Updated HTML to plain text conversion handling. (#6083)
• Updated image upload handling to validate referenced page. (#6126)
• Updated JavaScript packages. (#6090)
• Updated module install command with usability improvements. (#6094, #6066)
• Updated new WYSIWYG editor with a range of fixes. (#6119, #5631)
• Updated translations with latest Crowdin changes. (#6084)
• Fixed misaligned link attachment validation rules. (#6093)
• Fixed non-ascii character issues in headers on PDF exports. Thanks to @alexwoo-awso. (#6069, #6107)