Threats affecting pkg:github/DokuWiki

DokuWiki versions before 2026-07-14c contain a PHP object injection vulnerability in the Draft::getDraftText() function. This flaw allows authenticated users with edit rights to exploit a race condition in concurrent draft rewrites, enabling them to inject serialized data that can instantiate dangerous objects. The vulnerability can lead to arbitrary file write, deletion, and remote code execution. A fix is available in version 2026-07-14c.