Description
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DokuWiki | DokuWiki | < 2026-07-14c | 2026-07-14c |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dokuwiki | 2026-07-14.c+dfsg-1 | — |
| Debian 13 | dokuwiki | No fix yet | — |
| Debian 12 | dokuwiki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dokuwiki | No fix yet | — |
| Ubuntu 26.04 LTS | dokuwiki | No fix yet | — |
| Ubuntu 24.04 LTS | dokuwiki | No fix yet | — |
| Ubuntu 22.04 LTS | dokuwiki | No fix yet | — |
| Ubuntu 20.04 LTS | dokuwiki | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | dokuwiki | No fix yet | — |
| Ubuntu 16.04 LTS | dokuwiki | No fix yet | — |
References
- https://github.com/dokuwiki/dokuwiki/issues/4752 issue-tracking
- https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538 exploit technical-description
- https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681 patch
- DokuWiki release-2026-07-14c Release Notes release-notes
- https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122 technical-description
- VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition third-party-advisory