CVE-2026-113356

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2026-07-14c

Description A PHP object injection issue exists in the Draft::getDraftText() function. The software passes draft file contents to the unserialize() function without restricting allowed classes. Authenticated users with edit rights can exploit a race condition during concurrent draft rewrites to splice serialized data. This allows the instantiation of gadgets such as MemoryIndex or Installer, which can lead to arbitrary file write, file deletion, and remote code execution. In certain configurations, this may be possible without authentication.

Recommendations Update DokuWiki to version 2026-07-14c or later.