Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113356DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

High 7.5

In plain English

A high-severity unsafe deserialization in DokuWiki from DokuWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12dokuwikino fix listedDEBIAN-CVE-2026-113356
Debian:13dokuwikino fix listedDEBIAN-CVE-2026-113356
Debian:14dokuwiki2026-07-14.c+dfsg-1DEBIAN-CVE-2026-113356
Ubuntu:22.04:LTSdokuwikino fix listedUBUNTU-CVE-2026-113356
Ubuntu:24.04:LTSdokuwikino fix listedUBUNTU-CVE-2026-113356
Ubuntu:26.04:LTSdokuwikino fix listedUBUNTU-CVE-2026-113356
Ubuntu:26.10dokuwikino fix listedUBUNTU-CVE-2026-113356

Affected products (as reported)

VendorProductVersions
DokuWiki DokuWiki 0 – before 2026-07-14c

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References