DokuWiki CVE-2026-113356

Requires (1) an authenticated DokuWiki account holding edit/write rights on at least one page (PR:L - not anonymous), and (2) winning a race condition by issuing concurrent draft rewrites to splice attacker-controlled serialized data into the draft file consumed by Draft::getDraftText(), which calls unserialize() without an allowed_classes restriction. Successful code execution further depends on a usable PHP POP gadget being present in the DokuWiki codebase (e.g., MemoryIndex or Installer), which ship with the core. Limiting factors: exploitation is gated on prior authentication and edit permission, and the race (CVSS AT:P) is non-deterministic so success may need repeated attempts; instances where only trusted administrators can edit face substantially reduced exposure. This affects default configurations of DokuWiki versions before 2026-07-14c - no unusual non-default setting is required beyond granting edit rights.

This is a credible but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 7.7 High, and the impact triad is maximal (VC:H/VI:H/VA:H) because successful PHP object injection via CWE-502 yields arbitrary file write, deletion, and code execution. Two factors temper the raw score: PR:L means the attacker must already hold an authenticated account with edit rights (not anonymous), and AT:P (Attack Requirements: Present) reflects the need to win a race condition on concurrent draft rewrites, which is non-deterministic and not guaranteed on a single attempt. A publicly available exploit (VulnCheck researcher gist) raises practical risk because it lowers the skill barrier, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - this is POC-available, not confirmed in-the-wild. Signals are internally consistent (network-reachable code path, authenticated low-privilege actor, race-gated, full host compromise on success); no contradictions between vector and description were found. Net: prioritize patching for any multi-user DokuWiki instance where untrusted or semi-trusted accounts can edit pages, but single-admin or tightly-trusted deployments face lower real-world exposure.

A low-privileged but authenticated DokuWiki user with page-edit rights repeatedly opens and saves drafts while concurrently writing crafted serialized PHP into the draft file, racing the legitimate rewrite so that Draft::getDraftText() feeds attacker-controlled data to unserialize(). By splicing in a serialized MemoryIndex or Installer gadget, they trigger a POP chain leading to arbitrary file write and remote code execution on the web server. A public proof-of-concept exploit exists (researcher gist linked from the advisory), lowering the effort required, though the race condition (CVSS AT:P) means exploitation may take multiple attempts.