PHP Object Injection in DokuWiki

Executive Summary

This is a PHP object injection vulnerability in DokuWiki versions before 2026-07-14c. It occurs in the Draft::getDraftText() function where unserialized draft file contents are passed to unserialize() without restricting allowed classes. Authenticated users with edit rights can exploit a race condition during concurrent draft rewrites to inject malicious serialized data. This allows instantiation of gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

Useful 0 Not Useful 0

Detection Guidance

Check DokuWiki version with 'grep -r "2026-07-14c" /path/to/dokuwiki/'. If version is older, inspect Draft.php for unserialize() calls without allowed_classes. Look for concurrent draft file modifications in logs. Use 'find /path/to/dokuwiki/data -name "*.draft" -type f' to locate draft files and check timestamps for anomalies.

Useful 0 Not Useful 0

Impact Analysis

An attacker with edit access could execute arbitrary code on your server, delete files, or modify system files. This could lead to complete compromise of your DokuWiki installation and potentially the underlying server. The vulnerability requires an authenticated user account with edit privileges, making it less likely for random attackers but still dangerous for shared or multi-user environments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality requirements. For HIPAA, it could compromise protected health information integrity. Both regulations require protection against unauthorized access and data breaches. Exploitation could result in compliance violations, fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to DokuWiki 2026-07-14c or later. If immediate upgrade is not possible, disable drafts by setting 'usedraft' to 0 in config. Clear all draft files and caches. Review and update plugins that may store objects in cache. Monitor for unusual file writes or deletions.

Useful 0 Not Useful 0