CVE-2026-113356

7.5High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Authenticated users with page-editing permissions can execute arbitrary code, write files, or delete files on the server. They achieve this by winning a race condition during concurrent draft rewrites to trigger PHP object injection.

Root cause

The Draft::getDraftText() function passes untrusted draft file contents directly to unserialize() without restricting allowed classes.

Affected systems

DokuWiki versions prior to 2026-07-14c

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade DokuWiki to version 2026-07-14c or later. If patching immediately is not possible, temporarily revoke edit permissions from untrusted accounts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113356