500 Internal Server Error with a specific page content #4877

New Issue

OVERLORD · 2026-02-05T09:23:19+03:00

OVERLORD commented

2026-02-05 09:23:19 +03:00

Originally created by @RELOC-DEV on GitHub (Jul 16, 2024).

Describe the Bug

Creating a new page with a code block contaning somewhere the string "/../" results in a internal server error when trying to save the page.

Steps to Reproduce

Create a new page
Assign a random title
In the page body create a code block ( click to "..." -> "Insert code block")
Fill the code block content with "/../" (without quotes)
Save Code
Save Page

A "500 Internal Server Error" page will be opened and the page will not be saved.

Expected Behaviour

The page should be saved correctly.

Screenshots or Additional Context

No response

Browser Details

Chrome 126

Exact BookStack Version

v24.02.2

Originally created by @RELOC-DEV on GitHub (Jul 16, 2024). ### Describe the Bug Creating a new page with a code block contaning somewhere the string "/../" results in a internal server error when trying to save the page. ### Steps to Reproduce 1. Create a new page 2. Assign a random title 3. In the page body create a code block ( click to "..." -> "Insert code block") 4. Fill the code block content with "/../" (without quotes) 5. Save Code 6. Save Page A "500 Internal Server Error" page will be opened and the page will not be saved. ### Expected Behaviour The page should be saved correctly. ### Screenshots or Additional Context _No response_ ### Browser Details Chrome 126 ### Exact BookStack Version v24.02.2

OVERLORD added the 🐛 Bug label 2026-02-05 09:23:19 +03:00

OVERLORD closed this issue

2026-02-05 09:23:20 +03:00

OVERLORD commented

2026-02-05 09:23:22 +03:00

@ssddanbrown commented on GitHub (Jul 16, 2024):

Hi @RELOC-DEV,
Please can you detail your BookStack host environment (web-server, hosting service (if any), operating system, PHP version and setup etc....)

@ssddanbrown commented on GitHub (Jul 16, 2024): Hi @RELOC-DEV, Please can you detail your BookStack host environment (web-server, hosting service (if any), operating system, PHP version and setup etc....)

OVERLORD commented

2026-02-05 09:23:23 +03:00

@RELOC-DEV commented on GitHub (Jul 16, 2024):

Hi @ssddanbrown, thanks for your reply!

The hosting service is Dreamhost.
It runs Ubuntu 20.04.6 LTS with PHP 8.2

@RELOC-DEV commented on GitHub (Jul 16, 2024): Hi @ssddanbrown, thanks for your reply! The hosting service is Dreamhost. It runs Ubuntu 20.04.6 LTS with PHP 8.2

OVERLORD commented

2026-02-05 09:23:24 +03:00

@ssddanbrown commented on GitHub (Jul 17, 2024):

Thanks @RELOC-DEV. Errors on that kind of content are usually down the addition security systems/layers at play, blocking or stopping the request due to thinking there's an attack attempted.

I think dreamhost may have this kind of thing on by default. Often this will be named/due-to "mod_security" or a Web Application Firewall (WAF).
You could try contacting dreamhost regarding this to see if it's something that's active for you, or you could try following the guidance here if it's appropriate for your service, to see if disabling mod_security allows you to save this kind of content.

@ssddanbrown commented on GitHub (Jul 17, 2024): Thanks @RELOC-DEV. Errors on that kind of content are usually down the addition security systems/layers at play, blocking or stopping the request due to thinking there's an attack attempted. I think dreamhost may have this kind of thing on by default. Often this will be named/due-to "mod_security" or a Web Application Firewall (WAF). You could try contacting dreamhost regarding this to see if it's something that's active for you, or you could try following the [guidance here](https://help.dreamhost.com/hc/en-us/articles/215947927-Enabling-the-Web-Application-Firewall) if it's appropriate for your service, to see if disabling mod_security allows you to save this kind of content.

OVERLORD commented

2026-02-05 09:23:25 +03:00

@RELOC-DEV commented on GitHub (Jul 17, 2024):

Bingo! That was the issue.
Now the page is saved correctly.

We will assess if keeping this option disabled could be a security threat.

We appreciated very much your help.

@RELOC-DEV commented on GitHub (Jul 17, 2024): Bingo! That was the issue. Now the page is saved correctly. We will assess if keeping this option disabled could be a security threat. We appreciated very much your help.

OVERLORD referenced this issue

2026-02-05 10:31:46 +03:00

[PR #4877] [MERGED] Updated translations with latest Crowdin changes #6420

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4877