What’s Vulnerable › Vulnerabilities

CVE-2026-113356: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-502

Description

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Affected products

• DokuWiki: before 2026-07-14c — fixed in 2026-07-14c

How to fix

Upgrade to a fixed version: DokuWiki 2026-07-14c. Check the vendor advisory for mitigations.

References

• https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
• https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
• https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
• https://github.com/dokuwiki/dokuwiki/issues/4752
• https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c
• https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition

Get alerted when CVE-2026-113356 or the next vulnerability affects your stack