Sebsrt

**Name of the Vulnerable Software and Affected Versions** DokuWiki versions prior to 2026-07-14c **Description** A PHP object injection issue exists in the `Draft::getDraftText()` function. The software passes draft file contents to the `unserialize()` function without restricting allowed classes. Authenticated users with edit rights can exploit a race condition during concurrent draft rewrites to splice serialized data. This allows the instantiation of gadgets such as `MemoryIndex` or `Installer`, which can lead to arbitrary file write, file deletion, and remote code execution. In certain configurations, this may be possible without authentication. **Recommendations** Update DokuWiki to version 2026-07-14c or later.