Read the docs
TI-2026-76805 Aliases CVE-2026-113356GHSA-9xhj-2fcr-x9j8

PHP object injection in DokuWiki draft handling allows code execution

Priority HIGH 69CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

DokuWiki before 2026-07-14c passes draft file contents to unserialize() in Draft::getDraftText() without restricting allowed classes, a deserialization flaw (CWE-502). An authenticated user with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadget classes such as MemoryIndex or Installer to write or delete arbitrary files and execute code. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed DokuWiki (DokuWiki): 2026-07-14c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DokuWikiDokuWikibefore 2026-07-14c2026-07-14cPatch availableCNA
  • DokuWiki VendorDokuWiki Affected before 2026-07-14c Fixed in 2026-07-14c Patch available CNA

Remediation

Update DokuWiki to 2026-07-14c, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA DokuWiki (DokuWiki) Fixed in 2026-07-14c

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113356
  2. 2026-10-20 Alias added: GHSA-9xhj-2fcr-x9j8
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → HIGH
  5. 2026-10-21 Affected versions changed · Red Hat
  6. 2026-10-21 CVSS score added · Red Hat

References

Exploit 1

Patch 1

Other 3

  • TI-2026-21339 Resource allocation without limits in DokuWiki CVSS 3.1HIGH 7.5
  • TI-2019-15392 Dokuwiki 2018-04-22b - Username Enumeration CVSS 4.0MEDIUM 6.9
  • TI-2009-01868 inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when… CVSS 2.0HIGH 9.3
  • TI-2023-17236 DokuWiki before 2023-04-04a allows XSS via RSS titles. CVSS 3.1MEDIUM 5.4
  • TI-2018-11034 CSV Injection (aka Excel Macro Injection or Formula Injection) in… CVSS 3.0CRITICAL 9.6
  • TI-2010-00275 A typo in the administrator permission check in the ACL Manager plugin… CVSS 2.0HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences