What is the CVSS score of CVE-2026-37106?

CVE-2026-37106 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of DokuWiki are affected by CVE-2026-37106?

DokuWiki 2025-05-14b 'Librarian' contains a critical remote code execution vulnerability (CVE-2026-37106, CVSS 9.8) affecting all internet-facing instances without requiring authentication or user…

How to fix or mitigate CVE-2026-37106?

Within 24 hours: Identify all DokuWiki instances and immediately isolate internet-facing deployments from public access. Within 7 days: Implement network-level access controls restricting DokuWiki to internal networks, disable user registration if operationally feasible, and deploy IDS/IPS monitoring for exploitation attempts. Within 30 days: Monitor official DokuWiki security advisories for patch availability; evaluate migration to alternative wiki solutions if patch timeline extends beyond 30 days.

DokuWiki CVE-2026-37106

EUVD-2026-40863 CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-06-30 cve@mitre.org

GHSA-4856-qxx9-mgf3

PHP RCE Red Hat

Critical

Disputed · 9.8 Vendor: mitre

Severity by source

Sources disagree (Low–Critical)

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description asserts unauthenticated remote code execution via a public registration endpoint (AV:N/AC:L/PR:N/UI:N) with total impact, though the CWE-640 mapping leaves true impact uncertain.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

3.7 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:31 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 30, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to execute arbitrary code via the register function in inc/auth.php

AnalysisAI

Remote code execution is claimed in DokuWiki 2025-05-14b "Librarian" (build 56.2) via the register function in inc/auth.php, which security intelligence maps to CWE-640 (weak password-recovery mechanism) - a mismatch that suggests account-takeover-to-code-execution rather than a direct memory-corruption RCE. The CVSS 3.1 score of 9.8 (network, no authentication, no user interaction) implies any internet-facing DokuWiki instance is at risk, and publicly available exploit code exists (a public gist proof-of-concept plus SSVC 'poc' exploitation status), though EPSS remains low at 0.26% (17th percentile), indicating no observed mass exploitation yet. Reported by MITRE and tracked as ENISA EUVD-2026-40863, it is tagged PHP/RCE but is not listed in CISA KEV.

Technical ContextAI

DokuWiki is a widely used PHP-based, file-backed (no database) open-source wiki. The flaw resides in inc/auth.php, the core authentication library, specifically the register() routine that handles new-user self-registration. The assigned weakness CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) points to a logic defect in how account credentials or registration/recovery tokens are validated, rather than a classic buffer overflow or deserialization bug. The 'PHP' and 'RCE' tags plus the reference to inc/auth.php imply that abuse of the registration path can be leveraged to reach code execution - plausibly via privileged account creation followed by admin functionality, or PHP-level injection during the auth flow. The CPE/affected-version data is unresolved (EUVD lists 'n/a n/a'), so exact code-level root cause cannot be confirmed from the provided sources; the upstream DokuWiki GitHub repo and issue #4682 are cited for tracking.

RemediationAI

No vendor-released patch version is identified at time of analysis - the provided references point to the DokuWiki GitHub repository and issue #4682 rather than a tagged fixed release, so monitor https://github.com/dokuwiki/dokuwiki and issue #4682 for an official patched build and upgrade to it as soon as it is published. As the primary compensating control, disable open self-registration by setting the DokuWiki configuration option $conf['disableactions'] to include 'register' (Admin > Configuration Settings > Disable DokuWiki actions), which removes the vulnerable code path's public entry point at the cost of preventing new users from self-enrolling (admins must provision accounts manually). Additionally, restrict access to the wiki behind authentication or IP allow-listing at the reverse proxy for non-public deployments, and review the user manager for any unexpected or newly created accounts. Confirm the exact fixed version from the vendor before relying on a specific upgrade target; do not deploy an invented version number.