Summary
DokuWiki contains a PHP object injection vulnerability in draft handling because draft contents are passed to unserialize() without restricting permitted classes. An authenticated user with edit rights may race concurrent draft rewrites to inject serialized objects, potentially enabling arbitrary file operations or code execution through available gadget chains.
DokuWiki contains a PHP object injection vulnerability in draft handling because draft contents are passed to unserialize() without restricting permitted classes. An authenticated user with edit rights may race concurrent draft rewrites to inject serialized objects, potentially enabling arbitrary file operations or code execution through available gadget chains.
Affected context
The issue may affect DokuWiki deployments where:
- Authenticated users have permission to edit pages and create or update drafts
- Draft data is processed by
Draft::getDraftText() - Draft files can be modified through concurrent rewrite behavior
- PHP object deserialization can instantiate application or framework classes without an allowed-class restriction
Exploitability depends on the configured permissions, timing behavior, and availability of usable gadget classes.
The issue may affect DokuWiki deployments where:
- Authenticated users have permission to edit pages and create or update drafts
- Draft data is processed by
Draft::getDraftText() - Draft files can be modified through concurrent rewrite behavior
- PHP object deserialization can instantiate application or framework classes without an allowed-class restriction
Exploitability depends on the configured permissions, timing behavior, and availability of usable gadget classes.
Exploit preconditions
- Attack surface: DokuWiki draft management and editing functionality
- Required access: An authenticated account with edit rights
- Trigger point: Processing draft contents through
Draft::getDraftText() - Timing condition: The attacker must be able to coordinate concurrent draft rewrites to influence serialized data
- Why exploitation is possible: Unrestricted deserialization may instantiate attacker-influenced PHP objects, including classes that expose file or command execution behavior
- Attack surface: DokuWiki draft management and editing functionality
- Required access: An authenticated account with edit rights
- Trigger point: Processing draft contents through
Draft::getDraftText() - Timing condition: The attacker must be able to coordinate concurrent draft rewrites to influence serialized data
- Why exploitation is possible: Unrestricted deserialization may instantiate attacker-influenced PHP objects, including classes that expose file or command execution behavior
Why this happens
The vulnerability results from passing attacker-influenced draft data to PHP unserialize() without constraining which classes may be created. PHP deserialization can invoke object construction and lifecycle behavior for serialized classes, allowing existing application classes to act as gadget chains when their methods perform sensitive operations. This behavior maps to CWE-502: Deserialization of Untrusted Data.
The vulnerability results from passing attacker-influenced draft data to PHP unserialize() without constraining which classes may be created. PHP deserialization can invoke object construction and lifecycle behavior for serialized classes, allowing existing application classes to act as gadget chains when their methods perform sensitive operations. This behavior maps to CWE-502: Deserialization of Untrusted Data.
Potential impact
- An attacker may write or delete files accessible to the DokuWiki process
- An attacker could alter application content or configuration
- Available gadget chains may enable arbitrary PHP or operating system command execution
- The DokuWiki instance may be compromised
- Compromise could support persistence, data manipulation, or lateral movement
- An attacker may write or delete files accessible to the DokuWiki process
- An attacker could alter application content or configuration
- Available gadget chains may enable arbitrary PHP or operating system command execution
- The DokuWiki instance may be compromised
- Compromise could support persistence, data manipulation, or lateral movement
General mitigation guidance
Mitigation generally focuses on removing unsafe object deserialization and reducing trust in draft data.
Common defensive patterns include:
- Prefer structured data formats that do not instantiate executable objects
- Replace unrestricted
unserialize()calls with constrained parsing and explicit data reconstruction - Apply strict allowed-class policies when object deserialization cannot be avoided
- Validate draft content and enforce integrity protections before processing it
- Serialize only narrowly defined data-transfer structures rather than general application objects
- Run the application with least-privilege filesystem and operating-system permissions
- Restrict authenticated editing capabilities to trusted users and protect draft storage from unauthorized modification
Mitigation generally focuses on removing unsafe object deserialization and reducing trust in draft data.
Common defensive patterns include:
- Prefer structured data formats that do not instantiate executable objects
- Replace unrestricted
unserialize()calls with constrained parsing and explicit data reconstruction - Apply strict allowed-class policies when object deserialization cannot be avoided
- Validate draft content and enforce integrity protections before processing it
- Serialize only narrowly defined data-transfer structures rather than general application objects
- Run the application with least-privilege filesystem and operating-system permissions
- Restrict authenticated editing capabilities to trusted users and protect draft storage from unauthorized modification
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying
unserialize()calls on request, file, draft, cache, or other user-influenced data - Code review checks for missing allowed-class restrictions and unsafe magic-method behavior
- Searches for gadget classes that write, delete, include, or execute files during deserialization
- Monitoring for unusual concurrent draft updates, unexpected draft-file changes, and web-process file modifications
- Policy enforcement that blocks unrestricted PHP deserialization in application code
Automated security review tools may help identify dangerous data flows, but findings should be validated against actual permissions and runtime behavior.
Organizations can look for this class of issue through:
- Static analysis rules identifying
unserialize()calls on request, file, draft, cache, or other user-influenced data - Code review checks for missing allowed-class restrictions and unsafe magic-method behavior
- Searches for gadget classes that write, delete, include, or execute files during deserialization
- Monitoring for unusual concurrent draft updates, unexpected draft-file changes, and web-process file modifications
- Policy enforcement that blocks unrestricted PHP deserialization in application code
Automated security review tools may help identify dangerous data flows, but findings should be validated against actual permissions and runtime behavior.
