CVE-2026-113356

7.5 HIGHpublic exploit available

Published 2026-10-20 · Updated 2026-10-20

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Public exploit & PoC references

https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
https://github.com/dokuwiki/dokuwiki/issues/4752
https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c

All references

https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
https://github.com/dokuwiki/dokuwiki/issues/4752
https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c
https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2017-20285PoC
HIGHCVE-2019-25777PoC
UNSCOREDCVE-2025-30047
CRITICALCVE-2025-59953PoC
UNSCOREDCVE-2025-64393
CRITICALCVE-2025-66455PoC
HIGHCVE-2026-100214
HIGHCVE-2026-100308PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.