CVE-2026-113356

EUVD-2026-104927
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.74%
Common Weakness Enumeration
References
https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
https://github.com/dokuwiki/dokuwiki/issues/4752
https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c
https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition