CVE-2026-113356: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DokuWikito a version that resolves this vulnerability.Fixed in 2026-07-14c
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have edit rights in DokuWiki. The attack also requires racing concurrent draft rewrites, making exploitation dependent on timing.
What impact can successful exploitation have?
Successful exploitation can instantiate PHP object gadgets such as MemoryIndex or Installer. The described outcomes include arbitrary file write, file deletion, and code execution.
Which versions are affected?
DokuWiki versions before 2026-07-14c are affected. The provided data does not identify a more specific affected version range.
Is a default installation affected?
The issue is reachable through draft handling in Draft::getDraftText(), but the provided data does not state whether draft functionality and the required edit permissions are enabled in a default installation.