CVE-2026-113356
Description
A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw (race condition) during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization without restricting permitted classes, the attacker can achieve arbitrary code execution and modify or delete files on the server.
Statement
This vulnerability is rated as Important because authenticated users with page editing privileges can exploit insecure PHP object deserialization during concurrent draft handling to achieve arbitrary code execution and compromise the host environment. Although exploitation requires valid user credentials and precise timing to trigger the race condition, the resulting impact can severely compromise file integrity and system availability. DokuWiki is not distributed or supported in Red Hat Enterprise Linux, and its presence is limited to community distributions such as Fedora.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce class allowlisting during deserialization to disallow instantiation of arbitrary PHP objects from draft and cache files: upgrade to DokuWiki 2026-07-14c (or the fixed Dokuwiki builds), which restrict unserialize() by setting allowed_classes to false for drafts, metadata, and extension caches, and allowed_classes to stdClass for instruction caches, closing concurrent draft write race condition splicing serialized payloads. Until patched, this is a concern on DokuWiki deployments with draft functionality (usedraft) enabled and page edit access, so disable the usedraft configuration setting and restrict or audit accounts with page edit privileges or anonymous edit access. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure deserialization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data; Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
Availability
Technical Impact: DoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
Other
Technical Impact: Varies by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform unauthorized actions, such as generating a shell.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
