shouldiuse.io

VERDICT

Should I use BookStack?

BookStack is a simple, open-source, self-hosted, easy-to-use platform for organising and storing information. - bookstackapp.com

Depends. A strong buy if you're a small team or individual comfortable running and patching your own server — it's free, mature, and well-liked. Skip it if you want zero maintenance, vendor support, or heavy customization.

Confidence

Medium. Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityCommunity-driven; no vendor support evidence found
  • Security posture

Pricing

$0

Self-hosted

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Managed hosting~$5+/mo

Best for

  • Self-hosters and homelab users
  • Small teams documenting IT and runbooks
  • Confluence refugees wanting free
  • Consultants doing client documentation

Not for

  • Teams with nobody to run and patch a server
  • Enterprises needing vendor SLAs or enterprise support
  • Anyone wanting polished theming or deep visual customization
  • Non-technical teams who just want to open a browser and write

Gotchas - check before you buy

high

Repeated auth-bypass and RCE CVEs — you must patch quickly or stay exposed.

medium

'Free' still costs: managed hosting runs ~$5+/month, plus your admin time.

medium

No funded company behind it — support is community-only (Reddit, GitHub).

low

The project itself admits it's 'not the solution for everyone' — check its alternatives page.

Pros and cons

Pros

  • Fully free and open source under the MIT license — no paywalls.
  • Clean Books→Chapters→Pages structure users find easy and flexible.
  • Ten-year-old project with steady releases and security patches.
  • Zero licensing cost especially appeals to small businesses.

Cons

  • Very limited visual customisation.
  • Opinionated structure doesn't fit every team's workflow.
  • Best when small; reviewers note limits at scale.
  • Self-hosting means you run, update, and secure it yourself.

Sources & method

Analyzed 9/20/2026 - 12 sources - Active project with frequent security releases — but multiple CVEs, including auth bypasses and RCE, mean prompt patching is essential.

official x1review x5security x4news x2
  • CVE-2026-82450 — Remote Code Execution, RCE affecting BookStack before 26.05.4.
  • CVE-2026-67204 — Auth bypass, Authentication bypass vulnerability disclosed August 2026.
  • CVE-2026-89022 — Social login auth bypass, Authentication bypass via a social login provider.
  • CVE-2023-6199 — Local file read via blind SSRF, LFR via blind SSRF, addressed in v23.10.2/3.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free, MIT-licensed, no feature paywalls
  • Ease of use: 4/5. Praised as simple and clean; setup needs technical skill
  • Feature depth: 3/5. Opinionated and simple; limited customization, suits smaller scale
  • Support quality. Community-driven; no vendor support evidence found
  • Security posture: 3/5. Regular security releases, but repeated auth-bypass and RCE CVEs
  • $0 Price Fully free, MIT-licensed
  • ~$5/mo Managed hosting Via third-party providers
  • 10 years Project age Community-run, no VC funding
  • ~3,231 Live sites Tracked by BuiltWith

Pricing

Self-hosted

$0

  • MIT license, all features included
  • You provide server, updates, backups

Managed hosting

~$5+/mo

  • Third-party providers (e.g. peaknetworks)
  • Hosting handled for you

Security

Active project with frequent security releases — but multiple CVEs, including auth bypasses and RCE, mean prompt patching is essential.

  • CVE-2026-82450 — Remote Code ExecutionRCE affecting BookStack before 26.05.4.⁸
  • CVE-2026-67204 — Auth bypassAuthentication bypass vulnerability disclosed August 2026.⁹
  • CVE-2026-89022 — Social login auth bypassAuthentication bypass via a social login provider.
  • CVE-2023-6199 — Local file read via blind SSRFLFR via blind SSRF, addressed in v23.10.2/3.10

What users say

Users consistently praise BookStack's simplicity and structure for small teams, while flagging limited customization and its small-scale fit.

“BookStack is great if you're small.”
Hacker News
“Very limited visual customisation.”
Software Advice review
“I want to recommend Bookstack as well.”
Reddit, r/sysadmin
Full analysis

Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Free, well-liked self-hosted wiki for small teams — but you own the server, the patching, and the risk.

Methodology

Based on ~50 public sources: review sites, Reddit, Hacker News, security trackers, and official docs.

Sources

  1. review
  2. review
  3. review
  4. review
  5. review
  6. official
  7. security
  8. security
  9. security
  10. security
  11. news
  12. news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.