CVE catalog

CVE-2026-113356

dokuwiki: CVE-2026-113356

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.54% · Oct 25, 2026

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandokuwikisid2026-07-14.c+dfsg-3fixed
Debiandokuwikiforky2026-07-14.c+dfsg-3fixed
Debiandokuwikitrixie2024-02-06b+dfsg-9vulnerable
Debiandokuwikibookworm0.0.20220731.a-2vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1ubuntu1vulnerable
Ubuntudokuwiki18.040.0.20160626.a-2vulnerable
Ubuntudokuwiki20.040.0.20180422.a-2vulnerable
Ubuntudokuwiki22.040.0.20180422.a-2.1vulnerable
Ubuntudokuwiki24.040.0.20220731.a-2vulnerable
Ubuntudokuwiki26.102025-05-14.b+dfsg-5vulnerable
Ubuntudokuwiki26.102025-05-14.b+dfsg-6vulnerable
Ubuntudokuwiki26.102026-07-14.a+dfsg-2vulnerable
Ubuntudokuwiki26.042024-02-06b+dfsg-9vulnerable
Ubuntudokuwiki26.042025-05-14.a+dfsg-4vulnerable
Ubuntudokuwiki26.042025-05-14.b+dfsg-1vulnerable
Ubuntudokuwiki26.042025-05-14.b+dfsg-2vulnerable
Ubuntudokuwiki26.042025-05-14.b+dfsg-3vulnerable
Ubuntudokuwiki26.042025-05-14.b+dfsg-4vulnerable
Ubuntudokuwiki26.042025-05-14.b+dfsg-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandokuwikisourcesid2026-07-14.c+dfsg-1not yet assignedNot reportedNot reported
Debiandokuwikisourceforky2026-07-14.c+dfsg-1not yet assignedNot reportedNot reported
Debiandokuwikisourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiandokuwikisourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dokuwiki]Affected
    Details (2)

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

[Debian 13 (Trixie)]

  • [dokuwiki]Affected
    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Affected

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Affected

      dsa · dokuwiki · debian · 13

  • [dokuwiki-farm]Affected

    Source package: [dokuwiki]

    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Affected

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Affected

      dsa · dokuwiki · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]