Bug 2556268

Summary:	CVE-2026-113356 dokuwiki: dokuwiki: Arbitrary code execution via insecure draft deserialization [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Laura Pardo <lpardo>
Component:	dokuwiki	Assignee:	Artur Frenszek-Iwicki <fedora>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	fedora
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f5684c50-0a95-4d7d-88d7-b1568ea87472"]}
Fixed In Version:	dokuwiki-20260714c-1.fc46, dokuwiki-20260714c-1.fc45, dokuwiki-20250514b-8.fc44, dokuwiki-20250514b-6.fc43	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-20 16:19:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2556118

Description Laura Pardo 2026-10-20 15:50:56 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Comment 1 Artur Frenszek-Iwicki 2026-10-20 16:19:40 UTC

> DokuWiki before 2026-07-14c
DokuWiki is already at version 2026-07-14c in Fedora Rawhide and Fedora 45 Beta.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-62c467b092
https://bodhi.fedoraproject.org/updates/FEDORA-2026-2ec7f70c76

Fedora 44 and Fedora 43 are at version 2025-05-14b, but had the bugfix backported:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9bbb604ea2
https://bodhi.fedoraproject.org/updates/FEDORA-2026-046b69d591