Deserialization in Dokuwiki
CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Vulnerability class: Insecure Deserialization
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/dokuwiki/dokuwiki/issues/4752 (issue-tracking)
- gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538 (technical-description, exploit)
- github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681 (patch)
- DokuWiki release-2026-07-14c Release Notes (release-notes)
- github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/… (technical-description)
- VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition (third-party-advisory)
Frequently asked questions
- What is CVE-2026-113356?
- CVE-2026-113356 is a high-severity vulnerability in Dokuwiki, classified under Deserialization of Untrusted Data. CVSS score: 7.5/10. Published 2026-10-20.
- How severe is CVE-2026-113356?
- High severity. CVSS v3 base score is 7.5 out of 10.