---
id: CVE-2026-113356
title: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
summary: >-
  DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in
  Draft::getDraftText() that passes draft file contents to unserialize() without
  restricting allowed classes. Authenticated users with edit rights can race
  concur…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-502
vendor: DokuWiki
product: DokuWiki
affected:
  - DokuWiki < 2026-07-14c
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T10:41:40.897Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113356'
references:
  - url: 'https://github.com/dokuwiki/dokuwiki/issues/4752'
  - url: 'https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538'
  - url: >-
      https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
  - url: 'https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c'
    label: DokuWiki release-2026-07-14c Release Notes
  - url: >-
      https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122
  - url: >-
      https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition
    label: >-
      VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via
      Draft Race Condition
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.324Z'
---

## Overview

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

## Affected

- `DokuWiki < 2026-07-14c`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.