CVE-2026-113356
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
DokuWiki DokuWiki
CVSS
7.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2026-07-14cDokuWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Text from CVE List
Affected versions 1
- DokuWikiaffected: all versions before 2026-07-14cCVE List
References 6
- github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681Fixvia CVE List
- github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14cFixvia CVE List
- vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-conditionAdvisoryvia CVE List
- gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538Exploitvia CVE List
- github.com/dokuwiki/dokuwiki/issues/4752Referencevia CVE List
- github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122Referencevia CVE List