BookStack Security Release v24.10.2
Dan Brown posted on the 13th of November 2024
BookStack v24.10.2 has been released.
This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that’s typically enabled in production web-serving environments, but it’s advised to update where uncertain.
Full List of Changes
- Updated application PHP dependencies.
- Updated translations with latest Crowdin changes. (#5317)
For More Information
If you have any questions or comments about this advisory:
- Open an issue in the BookStack GitHub repository.
- Ask on the BookStack Discord chat.
- Follow the BookStack security policy to contact someone privately.
Header Image Credits: Photo by Dietmar Rabich (CC-BY-SA 4.0) - Image Modified
