Skip to content

BookStack v25.12.1

Latest
Latest

Choose a tag to compare

View all tags
@ssddanbrown ssddanbrown released this 30 Dec 17:25
· 0 commits to development since this release
v25.12.1
This tag was signed with the committer’s verified signature.
ssddanbrown Dan Brown
GPG key ID: 116094FE15AE65C0
Verified
Learn about vigilant mode.
805fd98
This commit was signed with the committer’s verified signature.
ssddanbrown Dan Brown
GPG key ID: 116094FE15AE65C0
Verified
Learn about vigilant mode.

Security Release

BookStack v25.12.1 has been released.

This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.

We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.

Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.

Full List of Changes

  • Updated application PHP dependencies.
  • Add some additional resource-based limits. (#5968)
  • Updated translations with latest Crowdin changes. (#5962)
Assets 2
Loading