sebsrt@s3bsrt
A 12 year-old race condition to object injection and RCE, preauth in some configurations, I found in DokuWiki (CVE-2026-113356). https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
0000013
754 followersView on X
CVE-2026-113356
LOWCVSS 7.7 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
0.0/ 10 priority
Sources & remediation
Other references
- https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
- https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
- https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
- https://github.com/dokuwiki/dokuwiki/issues/4752
- https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c
Weakness type (CWE)
CWE-502
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day