Bug 2556118 (CVE-2026-113356)

Summary: CVE-2026-113356 dokuwiki: dokuwiki: Arbitrary code execution via insecure draft deserialization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw (race condition) during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization without restricting permitted classes, the attacker can achieve arbitrary code execution and modify or delete files on the server.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556268    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-20 10:52:37 UTC 
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.