shouldiuse.io

VERDICT

Should I use BookStack?

BookStack is a simple, open-source, self-hosted, easy-to-use platform for organising and storing information. - bookstackapp.com

Depends. A strong buy if you're a small team or individual comfortable running and patching your own server — it's free, mature, and well-liked. Skip it if you want zero maintenance, vendor support, or heavy customization.

Confidence

Medium. Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityCommunity-driven; no vendor support evidence found
  • Security posture

Pricing

$0

Self-hosted

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Managed hosting~$5+/mo

Best for

  • Self-hosters and homelab users
  • Small teams documenting IT and runbooks
  • Confluence refugees wanting free
  • Consultants doing client documentation

Not for

  • Teams with nobody to run and patch a server
  • Enterprises needing vendor SLAs or enterprise support
  • Anyone wanting polished theming or deep visual customization
  • Non-technical teams who just want to open a browser and write

Gotchas - check before you buy

high

Repeated auth-bypass and RCE CVEs — you must patch quickly or stay exposed.

medium

'Free' still costs: managed hosting runs ~$5+/month, plus your admin time.

medium

No funded company behind it — support is community-only (Reddit, GitHub).

low

The project itself admits it's 'not the solution for everyone' — check its alternatives page.

Pros and cons

Pros

  • Fully free and open source under the MIT license — no paywalls.
  • Clean Books→Chapters→Pages structure users find easy and flexible.
  • Ten-year-old project with steady releases and security patches.
  • Zero licensing cost especially appeals to small businesses.

Cons

  • Very limited visual customisation.
  • Opinionated structure doesn't fit every team's workflow.
  • Best when small; reviewers note limits at scale.
  • Self-hosting means you run, update, and secure it yourself.

Sources & method

Analyzed 9/20/2026 - 12 sources - Active project with frequent security releases — but multiple CVEs, including auth bypasses and RCE, mean prompt patching is essential.

official x1review x5security x4news x2
  • CVE-2026-82450 — Remote Code Execution, RCE affecting BookStack before 26.05.4.
  • CVE-2026-67204 — Auth bypass, Authentication bypass vulnerability disclosed August 2026.
  • CVE-2026-89022 — Social login auth bypass, Authentication bypass via a social login provider.
  • CVE-2023-6199 — Local file read via blind SSRF, LFR via blind SSRF, addressed in v23.10.2/3.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free, MIT-licensed, no feature paywalls
  • Ease of use: 4/5. Praised as simple and clean; setup needs technical skill
  • Feature depth: 3/5. Opinionated and simple; limited customization, suits smaller scale
  • Support quality. Community-driven; no vendor support evidence found
  • Security posture: 3/5. Regular security releases, but repeated auth-bypass and RCE CVEs
  • $0 Price Fully free, MIT-licensed
  • ~$5/mo Managed hosting Via third-party providers
  • 10 years Project age Community-run, no VC funding
  • ~3,231 Live sites Tracked by BuiltWith

Pricing

Self-hosted

$0

  • MIT license, all features included
  • You provide server, updates, backups

Managed hosting

~$5+/mo

  • Third-party providers (e.g. peaknetworks)
  • Hosting handled for you

Security

Active project with frequent security releases — but multiple CVEs, including auth bypasses and RCE, mean prompt patching is essential.

  • CVE-2026-82450 — Remote Code ExecutionRCE affecting BookStack before 26.05.4.⁸
  • CVE-2026-67204 — Auth bypassAuthentication bypass vulnerability disclosed August 2026.⁹
  • CVE-2026-89022 — Social login auth bypassAuthentication bypass via a social login provider.
  • CVE-2023-6199 — Local file read via blind SSRFLFR via blind SSRF, addressed in v23.10.2/3.10

What users say

Users consistently praise BookStack's simplicity and structure for small teams, while flagging limited customization and its small-scale fit.

“BookStack is great if you're small.”
Hacker News
“Very limited visual customisation.”
Software Advice review
“I want to recommend Bookstack as well.”
Reddit, r/sysadmin
Full analysis

Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Free, well-liked self-hosted wiki for small teams — but you own the server, the patching, and the risk.

Methodology

Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Sources

  1. BookStack Review: The Self-Hosted Wiki Done Rightdocsio.co
    review
  2. BookStack Software Reviews, Demo & Pricingsoftwareadvice.com
    review
  3. BookStack Reviews 2026 — SelectHubselecthub.com
    review
  4. BookStack: Simple and Free Wiki Software — Hacker Newsnews.ycombinator.com
    review
  5. BookStack vs Wiki.js — Reddit r/selfhostedreddit.com
    review
  6. BookStackApp/BookStack on GitHub (MIT License)github.com
    official
  7. BookStack Security Release v26.03.1bookstackapp.com
    security
  8. BookStack before 26.05.4 RCE — VulnCheckvulncheck.com
    security
  9. CVE-2026-67204: BookStack Auth Bypass — SentinelOnesentinelone.com
    security
  10. BookStack v23.10.2 LFR via Blind SSRF — Fluid Attacksfluidattacks.com
    security
  11. BookStack company profile — Tracxntracxn.com
    news
  12. Websites using BookStack — BuiltWithtrends.builtwith.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.