A denial-of-service vulnerability in BookStack versions prior to 25.12.1 can be triggered through its search functionality. An attacker can craft a search query with 180 terms — mixing regular keywords, exact phrases, and tag filters — that generates expensive SQL queries with multiple OR LIKE clauses and full table scans.
The proof-of-concept uses 150 concurrent threads hammering the search endpoint with this payload for 30 seconds. The result is resource exhaustion that can take the application offline.
The exploit was published on April 29, 2026, by researcher Gabriel Rodrigues (TEXUGO). It was tested against BookStack v25.12 running on Docker with PHP 8.3 and MySQL 8.0. A CVE has been requested (ID: 1970573) but not yet assigned.
Users should update to BookStack 25.12.1 or later, which addresses the issue. As a workaround, rate limiting on the search endpoint and capping the number of search terms can reduce exposure.
