BigBlueButton
Collaboration · products/bigbluebutton.yaml · RSS
Latest 4.0.0 Oct 14, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 3.0 | 3.0.39 | Oct 2, 2026 |
| 2.7 | 2.7.16 | Dec 11, 2024 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 3.0 | 3.0.39 | Feb 28, 2025 | — · maintained |
| 2.7 | 2.7.16 | Sep 6, 2023 | May 31, 2025 · ended |
| 2.6 | 2.6.18 | Mar 20, 2023 | Feb 28, 2025 · ended |
| 2.5 | 2.5.18 | Jun 9, 2022 | Sep 6, 2023 · ended |
Recent releases
securityCommand Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg
securityUnauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6
securityBlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp
securityFixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR
securityCross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
securityCross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
securityfix(sec): harden static asset path resolution by @prlanzarin https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c
securityfix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9
securityfix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w
securityfix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9
Security advisories
3.1 GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access
7.3 GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player
5.0 GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery
5.4 GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options