Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
bookstackapp book stack 23.10.2