CVE-2026-113356

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113356
Published
2026-10-20T10:41:40Z
Modified
2026-10-21T02:55:52Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
Details

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113356.json"
}
References

Affected packages

Git / github.com/dokuwiki/dokuwiki

Affected ranges

Type
GIT
Repo
https://github.com/dokuwiki/dokuwiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e674707568da10ecfdba47a1c21acccefd168ff9
Fixed
1531802afb2ac3eea147a887600fa5750e74e681
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026-07-14c"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "1531802afb2ac3eea147a887600fa5750e74e681"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "release-2026-07-14c",
            "range":  [
                {
                    "fixed":  "e674707568da10ecfdba47a1c21acccefd168ff9"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
release-2005-07-01
release-2005-07-13
release-2005-09-19
release-2005-09-22
release-2006-03-05
release-2006-03-09
release-2006-09-28rc
release-2006-10-08rc
release-2006-10-19rc
release-2006-11-06
release-2007-05-24rc
release-2007-06-26
release-2008-03-31rc
release-2008-04-11rc
release-2008-05-04
release-2008-05-05
release-2009-01-26rc
release-2009-01-30rc
release-2009-02-06rc
release-2009-02-14
release-2009-12-02rc
release-2009-12-25
release-2010-10-07rc
release-2010-10-27rc
release-2010-11-07
release-2010-11-07a
release-2011-11-10rc
release-2011_05_25
release-2011_05_25a
release-2012-01-25
release-2012-01-25b
release-2012-10-13
release-2012_09_10rc
release-2013-05-10
release-2013-05-10a
release-2013-10-28rc
release-2013-11-18rc
release-2013-12-08
release-2013_03_06rc
release-2014-05-05
release-2014-05-05a
release-2014-09-29
release-2014-09-29a
release-2014_09_29b
release-2014_09_29c
release-2014_09_29d
release-2015-08-10
release-2015-08-10a
release-2016-06-26
release-2016-06-26a
release-2017-02-19
release-2017-02-19a
release-2017-02-19b
release-2017-02-19c
release-2017-02-19d
release-2017-02-19e
release-2018-04-22
release-2018-04-22a
release-2018-04-22b
release-2018-04-22c
release-2020-06-01rc
release-2020-06-03rc
release-2020-06-09rc
release-2020-07-29
release-2022-06-26rc
release-2022-07-31
release-2022-07-31a
release-2023-04-04
release-2023-04-04a
release-2024-02-06
release-2024-02-06a
release-2024-02-06b
release-2025-05-14
release-2025-05-14a
release-2025-05-14b
release-2026-07-14
release-2026-07-14a
release-2026-07-14b

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113356.json"