CVE-2026-113356 in DokuWiki
Summary
by MITRE • 10/20/2026
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in DokuWiki versions prior to the 2026-07-14c release represents a critical security flaw rooted in improper handling of serialized data within the application's draft management subsystem. Specifically, the function Draft::getDraftText() is responsible for retrieving and processing user-generated content stored as drafts. The core technical deficiency lies in the direct invocation of PHP’s unserialize() function on file contents without implementing any form of class whitelisting or strict type checking. In modern PHP environments, deserializing untrusted data allows attackers to exploit gadget chains—sequences of existing classes whose methods can be chained together to perform unintended actions. By passing raw draft content directly into the deserialization engine, DokuWiki inadvertently exposes internal application objects that may contain sensitive functionality, such as file system manipulation or database interaction capabilities.
This vulnerability is particularly severe because it requires only authenticated access with edit privileges, a relatively low privilege level for many wiki users. An attacker who has obtained valid credentials can craft malicious draft content containing serialized payloads designed to instantiate specific gadget classes like MemoryIndex or Installer. The presence of these gadgets in the application's codebase provides the necessary building blocks for an attack chain. For instance, the Installer class may contain methods capable of writing files to arbitrary locations on the server filesystem, while other objects might facilitate data deletion or trigger remote code execution through subsequent function calls. This transforms a simple content editing capability into a powerful vector for full system compromise, allowing the attacker to escalate privileges and take control of the underlying web server infrastructure.
The operational impact of this vulnerability extends beyond immediate code execution. Because the attack involves race conditions during concurrent draft rewrites, an attacker can manipulate the timing of data persistence to splice serialized structures in ways that bypass basic integrity checks or trigger unexpected object states. This complexity makes detection by standard intrusion prevention systems more difficult and increases the likelihood of successful exploitation under load. The ability to write arbitrary files could lead to web shell deployment, while file deletion capabilities threaten data availability and integrity. Furthermore, code execution via gadget chains often results in complete loss of confidentiality for all data stored within or accessible through the wiki platform, including user credentials, private documents, and configuration settings that may expose backend systems.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade DokuWiki to version 2026-07-14c or later, where this deserialization flaw has been patched by implementing strict class whitelisting for the unserialize() function. This ensures that only explicitly approved classes can be instantiated during data retrieval, effectively neutralizing gadget chain attacks. For environments unable to upgrade immediately, administrators should enforce rigorous input validation and consider disabling draft functionality if not strictly required. Additionally, enabling PHP's disable_classes option or using a custom autoloader with strict filtering can provide an additional layer of defense against deserialization exploits. Regular security audits focusing on data flow analysis are recommended to identify similar patterns in other parts of the application that may handle untrusted input without proper sanitization.
From a classification perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data, and specifically relates to CWE-471 regarding modification of Assumed-Immutable Data through race conditions. In terms of offensive security frameworks, the exploitation technique maps to ATT&CK T1059, Command and Scripting Interpreter, as well as T1053, Scheduled Task/Job, if used for persistence via file writes. The attack vector also reflects aspects of T1204, User Execution, since it relies on an authenticated user interacting with the application interface to trigger the malicious payload. Understanding these mappings helps security teams prioritize patching efforts and configure monitoring rules to detect attempts to exploit similar deserialization flaws in other web applications that share common libraries or development patterns.