CVE-2026-113356

Name	CVE-2026-113356
Description	DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dokuwiki (PTS)	bookworm	0.0.20220731.a-2	vulnerable
	trixie	2024-02-06b+dfsg-9	vulnerable
	forky, sid	2026-07-14.c+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dokuwiki	source	(unstable)	2026-07-14.c+dfsg-1

Notes

https://github.com/dokuwiki/dokuwiki/issues/4752
https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681 (release-2026-07-14c)