---
id: "CVE-2026-113356"
kind: "vulnerability"
aliases: ["CVE-2026-113356"]
title: "DokuWiki: draft handling lets editors run code via PHP object injection"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokuwiki", "package", "php", "self-hosted"]
not_affected_if: ["no-edit-rights-users", "patched-version"]
published_at: "2026-10-20T11:17:20+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:10:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113356", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# DokuWiki: draft handling lets editors run code via PHP object injection

DokuWiki before 2026-07-14c passes draft file contents to PHP unserialize() without restricting classes, so a crafted draft can instantiate gadget classes. An attacker with edit rights can use a race on concurrent draft rewrites to gain arbitrary file write, deletion, and code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DokuWiki release date or version against `2026-07-14c` in the DokuWiki changelog or VERSION file
- unknown for other checks; the sources do not name a config setting or file path to inspect

## Fix

- Upgrade DokuWiki to `2026-07-14c` or later
- unknown for interim mitigations; the sources do not say

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113356

## From the sources

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_