21 lines
1.5 KiB
Markdown
21 lines
1.5 KiB
Markdown
# bookstack — triage (group D)
|
|
Pins: lscr.io/linuxserver/bookstack:26.09.1, mariadb:12.3 (no notices). Gates: none (own login only).
|
|
|
|
## Notice: release:BookStackApp/BookStack@v26.09.2 — REAL (app security release)
|
|
Read body of v26.09.2 (2026-10-20). Fixes: (1) comments of pages in the recycle bin still visible to API users;
|
|
(2) attachments of draft pages modifiable by other users holding attachment update/delete permission. Hardening: password
|
|
change drops remember-me cookies, ZIP import uncompressed-size check, SAML2 route CSRF-logout nuisance, PHP packages.
|
|
- Severity: unrated upstream (no GHSA); my read: low-medium (authorisation leaks between logged-in users).
|
|
- Login: any user (API access / attachment permission). Reachable: yes, but only to an account holder.
|
|
|
|
## Fix / target
|
|
Smallest fix: v26.09.2. Newest stable in main 26: v26.09.2 (newest release in the list).
|
|
TARGET: `lscr.io/linuxserver/bookstack:26.09.2` — exists on Docker Hub (2026-10-26, same digest as v26.09.2-ls293).
|
|
Tag style matches our pin (linuxserver bare version tag; it is re-pushed per ls build — ls291..ls293 so far).
|
|
Same main: yes (26). Breaking: none found (read v26.09.1, v26.09.2; APP_KEY requirement came in v26.09, already behind us).
|
|
linuxserver changelog: nothing since 05.08.26.
|
|
Lane: SECURITY_FIX.
|
|
|
|
Classifier note: `behind` = `26.09.20260929` is wrong — linuxserver's date-suffixed tag for v26.09 sorts above 26.09.x;
|
|
ignore `YY.MM.YYYYMMDD` tags when computing "behind".
|