CVE-2026-113356: DokuWiki 0 to before 2026-07-14c

Affected technology

DokuWiki · 0 to before 2026-07-14c
DokuWiki

Description’s affected range: before 2026-07-14c

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution. Vendor/CNA’s CVSS 4.0 assessment (base score 7.7/10) rates confidentiality, integrity and availability impact as high.

Published 20-Oct-2026 12:24 UTC

CWE: CWE-502
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 12:24:42.572884+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-113356.html