An authenticated user with edit permissions can exploit a PHP object injection flaw in DokuWiki’s draft handling to inject arbitrary serialized objects through a race condition in Draft::getDraftText(). The vulnerability allows attackers to instantiate gadget classes such as MemoryIndex or Installer, enabling arbitrary file manipulation, deletion, and execution of code on the server. The flaw originates from passing user provided draft content directly to unserialize() without restricting allowed classes.

DokuWiki versions released before 2026‑07‑14c are affected by this flaw. Any deployment of DokuWiki running an earlier release, regardless of the installed plugins or custom code, is vulnerable when users possess edit rights. No specific patch level beyond the 2026‑07‑14c release is available to mitigate this risk.

The CVSS score of 7.7 indicates a high severity. Although EPSS data is not available, the lack of a KEV listing does not diminish the potential impact for compromised or poorly protected installations. The likely attack vector requires an authenticated DokuWiki user who can edit pages; the attacker must be able to trigger two concurrent draft rewrites to splice malicious serialized data. Successful exploitation would give the attacker full control over file storage and potentially allow arbitrary code execution on the web server.