{"id":"CVE-2026-113356","kind":"vulnerability","aliases":["CVE-2026-113356"],"related":[],"title":"DokuWiki: draft handling lets editors run code via PHP object injection","description":"DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.","summary":"DokuWiki before 2026-07-14c passes draft file contents to PHP unserialize() without restricting classes, so a crafted draft can instantiate gadget classes. An attacker with edit rights can use a race on concurrent draft rewrites to gain arbitrary file write, deletion, and code execution.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokuwiki","package","php","self-hosted"],"not_affected_if":["no-edit-rights-users","patched-version"],"how_to_check":"- Check the installed DokuWiki release date or version against `2026-07-14c` in the DokuWiki changelog or VERSION file\n- unknown for other checks; the sources do not name a config setting or file path to inspect","fix":"- Upgrade DokuWiki to `2026-07-14c` or later\n- unknown for interim mitigations; the sources do not say","status":"open","published_at":"2026-10-20T11:17:20+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:10:51+00:00","updated_at":"2026-10-25T03:10:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DokuWiki to `2026-07-14c` or later\n- unknown for interim mitigations; the sources do not say","reach":"internet","title":"DokuWiki: draft handling lets editors run code via PHP object injection","impact":"high","summary":"DokuWiki before 2026-07-14c passes draft file contents to PHP unserialize() without restricting classes, so a crafted draft can instantiate gadget classes. An attacker with edit rights can use a race on concurrent draft rewrites to gain arbitrary file write, deletion, and code execution.","category":"package","nicknames":[],"who_cares":["dokuwiki","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker runs code on the wiki server","analyst_note":"Confirm the affected version range and whether a workaround exists; check the DokuWiki 2026-07-14c release notes at the NVD-linked advisory.","how_to_check":"- Check the installed DokuWiki release date or version against `2026-07-14c` in the DokuWiki changelog or VERSION file\n- unknown for other checks; the sources do not name a config setting or file path to inspect","needs_analyst":true,"not_affected_if":["patched-version","no-edit-rights-users"],"who_is_affected":"DokuWiki installations before 2026-07-14c where users hold edit rights, since the draft path is reached by authenticated editors. Sites where only anonymous readers exist, or which are already patched, can skip it. The sources do not say whether restricting edit rights blocks the race.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":3358,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-07':27B,73C '-113356':14A,17A '-14':28B,74C '-2026':13A,16A '2026':26B,72C 'allow':94C 'arbitrari':63B,117C 'attack':49B 'authent':96C 'c':29B,75C 'class':39B,47B,95C 'code':7A,68B,122C 'concurr':58B,103C 'contain':76C 'content':33B,89C 'craft':42B 'cve':12A,15A 'data':109C 'delet':66B,120C 'dokuwiki':1A,18B,24B,70C 'draft':2A,31B,43B,59B,83C,87C,104C 'edit':51B,99C 'editor':5A 'execut':69B,123C 'file':32B,64B,88C,118C 'gadget':46B,111C 'gain':62B 'getdrafttext':84C 'handl':3A 'host':23B 'inject':11A,80C 'instal':115C 'instanti':45B,110C 'let':4A 'like':112C 'memoryindex':113C 'object':10A,79C 'packag':19B 'pass':30B,86C 'php':9A,20B,35B,78C 'race':56B,102C 'restrict':38B,93C 'rewrit':60B,105C 'right':52B,100C 'run':6A 'self':22B 'self-host':21B 'serial':108C 'splice':107C 'unseri':36B,91C 'use':54B 'user':97C 'via':8A 'vulner':81C 'without':37B,92C 'write':65B,119C","nicknames":[],"mitigations":[],"who_affected":"DokuWiki installations before 2026-07-14c where users hold edit rights, since the draft path is reached by authenticated editors. Sites where only anonymous readers exist, or which are already patched, can skip it. The sources do not say whether restricting edit rights blocks the race.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113356","severity":null,"published_at":"2026-10-20T11:17:20+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}