CVE-2026-26477
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Dokuwiki version 2025-05-14b has a denial of service vulnerability in the media_upload_xhr() function in media.php. A remote attacker can cause a denial of service.
Risk Assessment
An attacker can crash the Dokuwiki service, disrupting access to documentation and team collaboration.
Recommendation
Update Dokuwiki to a version that includes a fix for this vulnerability.
Other vulnerabilities in Dokuwiki
See all- CVE-2026-113356High
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer.
- CVE-2026-37106Critical
In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.
- CVE-2023-34408Medium
DokuWiki before version 2023-04-04a allows XSS via RSS titles.
Original NVD description (English source)
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
Vulnerability data from NVD (NIST) · CISA KEV · EPSS