Live › vulnerability › CVE-2026-113356
Go to dashboardDokuWiki before 2026-07-14c passes draft file contents to PHP unserialize() without restricting classes, so a crafted draft can instantiate gadget classes. An attacker with edit rights can use a race on concurrent draft rewrites to gain arbitrary file write, deletion, and code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
DokuWiki installations before 2026-07-14c where users hold edit rights, since the draft path is reached by authenticated editors. Sites where only anonymous readers exist, or which are already patched, can skip it. The sources do not say whether restricting edit rights blocks the race.
No product ranges from the sources yet.
2026-07-14c in the DokuWiki changelog or VERSION file2026-07-14c or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-113356")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.