CVE-2026-113356

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113356", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T01:07:47.423Z", "datePublished": "2026-10-20T10:41:40.897Z", "dateUpdated": "2026-10-20T16:06:40.238Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-20T10:41:40.897Z"}, "datePublic": "2026-09-02T17:46:13.000Z", "title": "DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition", "descriptions": [{"lang": "en", "value": "DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "affected": [{"vendor": "DokuWiki", "product": "DokuWiki", "packageURL": "pkg:github/dokuwiki/dokuwiki", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2026-07-14c", "status": "affected", "versionType": "custom"}], "repo": "https://github.com/dokuwiki/dokuwiki"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:*", "versionEndExcluding": "2026-07-14c"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/dokuwiki/dokuwiki/issues/4752", "tags": ["issue-tracking"]}, {"url": "https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538", "tags": ["exploit", "technical-description"]}, {"url": "https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681", "tags": ["patch"]}, {"url": "https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c", "tags": ["release-notes"], "name": "DokuWiki release-2026-07-14c Release Notes"}, {"url": "https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition"}], "credits": [{"lang": "en", "value": "sebsrt", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T16:03:11.160358Z", "id": "CVE-2026-113356", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T16:06:40.238Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113356", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T16:03:11.160358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T16:03:11.904Z"}}], "cna": {"title": "DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition", "credits": [{"lang": "en", "type": "finder", "value": "sebsrt"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/dokuwiki/dokuwiki", "vendor": "DokuWiki", "product": "DokuWiki", "versions": [{"status": "affected", "version": "0", "lessThan": "2026-07-14c", "versionType": "custom"}], "packageURL": "pkg:github/dokuwiki/dokuwiki", "defaultStatus": "unaffected"}], "datePublic": "2026-09-02T17:46:13.000Z", "references": [{"url": "https://github.com/dokuwiki/dokuwiki/issues/4752", "tags": ["issue-tracking"]}, {"url": "https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538", "tags": ["exploit", "technical-description"]}, {"url": "https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681", "tags": ["patch"]}, {"url": "https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c", "name": "DokuWiki release-2026-07-14c Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition", "name": "VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization of Untrusted Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026-07-14c"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-20T10:41:40.897Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113356", "state": "PUBLISHED", "dateUpdated": "2026-10-20T16:06:40.238Z", "dateReserved": "2026-10-20T01:07:47.423Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-20T10:41:40.897Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/dokuwiki/dokuwiki", "product": "DokuWiki", "repo": "https://github.com/dokuwiki/dokuwiki", "vendor": "DokuWiki", "versions": [{"lessThan": "2026-07-14c", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution."}], "id": "CVE-2026-113356", "lastModified": "2026-10-20T20:06:37.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113356", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T16:03:11.160358Z", "version": "2.0.3"}}]}, "published": "2026-10-20T11:17:20.143", "references": [{"source": "disclosure@vulncheck.com", "url": "https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dokuwiki/dokuwiki/issues/4752"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "dokuwiki: dokuwiki: Arbitrary code execution via insecure draft deserialization", "id": "2556118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw (race condition) during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization without restricting permitted classes, the attacker can achieve arbitrary code execution and modify or delete files on the server."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enforce class allowlisting during deserialization to disallow instantiation of arbitrary PHP objects from draft and cache files: upgrade to DokuWiki 2026-07-14c (or the fixed Dokuwiki builds), which restrict unserialize() by setting allowed_classes to false for drafts, metadata, and extension caches, and allowed_classes to stdClass for instruction caches, closing concurrent draft write race condition splicing serialized payloads. Until patched, this is a concern on DokuWiki deployments with draft functionality (usedraft) enabled and page edit access, so disable the usedraft configuration setting and restrict or audit accounts with page edit privileges or anonymous edit access. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure deserialization defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)"}, "name": "CVE-2026-113356", "public_date": "2026-10-20T10:41:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-113356\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-113356\nhttps://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538\nhttps://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122\nhttps://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681\nhttps://github.com/dokuwiki/dokuwiki/issues/4752\nhttps://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c\nhttps://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition"], "statement": "This vulnerability is rated as Important because authenticated users with page editing privileges can exploit insecure PHP object deserialization during concurrent draft handling to achieve arbitrary code execution and compromise the host environment. Although exploitation requires valid user credentials and precise timing to trigger the race condition, the resulting impact can severely compromise file integrity and system availability. DokuWiki is not distributed or supported in Red Hat Enterprise Linux, and its presence is limited to community distributions such as Fedora.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026-07-14c)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "DokuWiki", "source": "cna", "vendor": "DokuWiki"}, "product": "dokuwiki", "vendor": "dokuwiki"}], "created": "2026-10-20T15:00:19.398876+00:00", "updated": "2026-10-20T17:15:14.199621+00:00", "vendors": ["dokuwiki", "dokuwiki$PRODUCT$dokuwiki"]}