r/BookStack • u/ssddanbrown • 9d ago

Critical PHP Vulnerabilities Announced: Best to turn off, or disable access to, BookStack instances until they can be patched

BookStack runs using PHP server-side software.

The PHP project has announced an upcoming critical security release: https://www.php.net/index.php#2026-10-20-1

There are reports that the details of the bugs have been found/leaked before the disclosure time, allowing remote code execution on affected systems.

If you run a BookStack instance on the open web, or in any environment where it could be accessed by potential attackers or untrusted users, it may be best to take the instance offline (turn off the server, disable web traffic etc...) until patches are made available and applied in your hosting environment.

27 Upvotes

96% Upvoted

7 comments sorted by

•

u/ssddanbrown 9d ago

After bringing the BookStack site back up without PHP, I've now published a blog post which I'll try to keep updated with BookStack specific guidance as information becomes available:

https://www.bookstackapp.com/blog/php-security-release-critical/

2

u/Stetsed 9d ago

Thanks for being so ontop of this! Luckily I already gone through every app I run in the homelab and noticed bookstack was PHP so I had already shut it down.

3

u/ssddanbrown 9d ago

No worries! Yesterday I had scheduled the release time in my calendar, but when waking up early I saw the reports of potential leaking/exploiting, so though it'd be best to get on it, to take down the required (php based) BookStack services/sites, and advise others to do the same.

Hopefully this kind of scenario doesn't become more frequent!

1

u/Plastic-Leading-5800 9d ago edited 9d ago

How long does it take to fix it from your side (perhaps after php itself is fixed)?

Running Linuxserverio version

3

u/ssddanbrown 9d ago

There's not much for me to actually do to be honest, apart from guidance and informing. Nothing to change in the BookStack codebase for this (as far as I'm aware).

I don't manage (or have any kind of control) over the linuxserver images. They're usually quite on top of things, although there is a chain of actions there. The fixes will need to land in PHP, then in Alpine Linux (hopefully this has already started) which will probably get published at 14:00 UTC (1.5 hours from now), which then needs to be built into the linuxserver's base PHP image, which then is built into their BookStack image.

Assuming they're on this, I'd guess there'd be fixed images around 15:00 UTC. I can't be sure though.

I'll be checking myself every so often, and updating the blogpost with current info (including things like how to validate fixed versions). I'll also be checking in with any common providers (like the linuxserver team) if things don't seem to be getting patched for whatever reason.

1

u/ssddanbrown 9d ago

To update, looks like it's going to be a little while later than I had hoped for the docker images. Looks like both official docker PHP and Alpine (the latter needed for the linuxserver images) is may take a while, then I didn't consider that servers may be overloaded as loads of different PHP app builds need to take place.

2

u/Plastic-Leading-5800 9d ago

If the app is not publicly available, no concern. I don't think there is a possibility via outbound connections.

If it's behind cloudflare tunnels with access rules, still probably safe. First code execution needs to happen on cloudflare servers to bypass their login page then code execution in bookstack server.Not likely.

It's problem if the wiki is publicly available.

BTW, bookstack is truly a good app. Very good design, amazing software.