DEBIAN-CVE-2026-113356

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-113356
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113356.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113356
Upstream
Published
2026-10-23T13:47:21Z
Modified
2026-10-23T14:00:50Z
Summary
[none]
Details

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

References

Affected packages

Debian:12 / dokuwiki

Package

Name
dokuwiki
Purl
pkg:deb/debian/dokuwiki?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0.20220731.a-2
0.0.20220731.a-3
Other
2024-02-06b-0exp1
2024-02-06b-0exp2
2024-02-06b-0exp3
2024-02-06b-0exp4
2024-02-06b+dfsg-0exp1
2024-02-06b+dfsg-0exp2
2024-02-06b+dfsg-1
2024-02-06b+dfsg-2
2024-02-06b+dfsg-3
2024-02-06b+dfsg-4
2024-02-06b+dfsg-5
2024-02-06b+dfsg-6
2024-02-06b+dfsg-7
2024-02-06b+dfsg-8
2024-02-06b+dfsg-9
2025-05-14+dfsg-1
2026-07-14a+dfsg-1
2026-07-14+dfsg-1
2025-05-14.*
2025-05-14.a+dfsg-1
2025-05-14.a+dfsg-2
2025-05-14.a+dfsg-3
2025-05-14.a+dfsg-4
2025-05-14.b+dfsg-1
2025-05-14.b+dfsg-2
2025-05-14.b+dfsg-3
2025-05-14.b+dfsg-4
2025-05-14.b+dfsg-5
2025-05-14.b+dfsg-6
2026-07-14.*
2026-07-14.a+dfsg-1
2026-07-14.a+dfsg-2
2026-07-14.a+dfsg-3
2026-07-14.c+dfsg-1
2026-07-14.c+dfsg-2
2026-07-14.c+dfsg-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113356.json"

Debian:13 / dokuwiki

Package

Name
dokuwiki
Purl
pkg:deb/debian/dokuwiki?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
2024-02-06b+dfsg-9
2025-05-14+dfsg-1
2026-07-14a+dfsg-1
2026-07-14+dfsg-1
2025-05-14.*
2025-05-14.a+dfsg-1
2025-05-14.a+dfsg-2
2025-05-14.a+dfsg-3
2025-05-14.a+dfsg-4
2025-05-14.b+dfsg-1
2025-05-14.b+dfsg-2
2025-05-14.b+dfsg-3
2025-05-14.b+dfsg-4
2025-05-14.b+dfsg-5
2025-05-14.b+dfsg-6
2026-07-14.*
2026-07-14.a+dfsg-1
2026-07-14.a+dfsg-2
2026-07-14.a+dfsg-3
2026-07-14.c+dfsg-1
2026-07-14.c+dfsg-2
2026-07-14.c+dfsg-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113356.json"

Debian:14 / dokuwiki

Package

Name
dokuwiki
Purl
pkg:deb/debian/dokuwiki?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026-07-14.c+dfsg-1

Affected versions

Other
2024-02-06b+dfsg-9
2025-05-14+dfsg-1
2026-07-14a+dfsg-1
2026-07-14+dfsg-1
2025-05-14.*
2025-05-14.a+dfsg-1
2025-05-14.a+dfsg-2
2025-05-14.a+dfsg-3
2025-05-14.a+dfsg-4
2025-05-14.b+dfsg-1
2025-05-14.b+dfsg-2
2025-05-14.b+dfsg-3
2025-05-14.b+dfsg-4
2025-05-14.b+dfsg-5
2025-05-14.b+dfsg-6
2026-07-14.*
2026-07-14.a+dfsg-1
2026-07-14.a+dfsg-2
2026-07-14.a+dfsg-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113356.json"