Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113356: DokuWiki draft editing can let attackers write or run files

CVE-2026-113356 · published 2 days ago

Summary

If a user who can edit pages creates or updates a draft in DokuWiki, they could race the system and insert malicious data that the software blindly processes. This can lead to unauthorized file creation, deletion, or execution of code on the server. Upgrade DokuWiki to the version released after 2026-07-14c or later to protect against this risk.

What to do

Update dokuwiki dokuwiki to version 2026-07-14c or later.

Affected software

Vendor	Product	Affected versions
dokuwiki	dokuwiki	< 2026-07-14c

Original advisory text

DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

References

https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538 Exploit
https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43c... Third Party Advisory
https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74... Patch
https://github.com/dokuwiki/dokuwiki/issues/4752 Third Party Advisory
https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c Vendor Advisory
https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-inje... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-1133... Vendor Advisory
https://github.com/dokuwiki/dokuwiki Product
https://nvd.nist.gov/vuln/detail/CVE-2026-113356 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published20 Oct 2026

Updated22 Oct 2026

First seen20 Oct 2026

Sources

CVE-2026-113356 · NVD

CVE-2026-113356 · MITRE

CVE-2026-113356 · OSV

Track software like this

Free during beta