I know a lot of you are running a DokuWiki somewhere, so that's why I'm bringing this up... On September 2nd, Andreas Gohr, who's been writing this wiki engine for over 20 years, publicly confirmed a critical flaw in his own bug tracker.
The report came from a researcher, sebastianosrt, who had sent the flaw's details by email but, having never received a , ended up opening a public ticket to say he couldn't reach the maintainer.
The email had ended up in spam...
Gohr fished it out eight minutes after the ticket was opened, and a bit over an hour later he himself labeled this bug as critical, since it allows remote code execution (RCE) and even arbitrary file deletion.
So as usual with this kind of news, there's good news and bad news. The good news is that you need write access on DokuWiki to exploit the thing. That means if your wiki is read-only, it can't be brought down. But the bad news is that if your wiki has editor accounts, or worse, open registration, then any one of those accounts can go from " I'm fixing a typo " to " I'm executing whatever I want on your server, nanananere ". And pretty much every DokuWiki version released over the past ten years is affected.
Don't worry, the fix came out that same evening , in version 2026-07-14c, but you'll have to update if you're on an older version, because the major releases didn't get a patch. And if you installed it via apt, for now, the fix hasn't been pushed to the repos. So for those who can't update right away, Gohr recommends disabling the usedraft option, which is enabled by default.
One last point, and an important one: this fix now forbids plugins from storing PHP objects in the opcode cache. Those that were doing so will break. For example, the forms from the bureaucracy plugin will end up erroring out on every page. As for the gallery plugin, it has already been updated to support this change... We'll see if the other plugins manage to keep up...
As for the rest, there's no CVE and no announcement anywhere else. Everything is happening in this ticket , and it's still open if you want to throw in your two cents ^^.
No paywall or programmatic ads. If the site is useful to you and you want it to remain free and independent, you can support it on Patreon.
DokuWiki - A critical flaw to patch immediately
NTLite - Clean up Windows before you've even installed it
Line Rider - Full speed on the sled track!
WinBtrfs - The Windows driver that mounts your Linux disks finally wakes up
HortusFox - The shared logbook for your plants
Google speeds up and releases Gemini 3.8 Flash
Il y a actuellement 42 visiteurs
Record : 1 337 le 12 juin 2007
Prenez vous en photo !
starfix! on DokuWiki - A critical flaw to
Morgane on NTLite - Clean up Windows befo
ts3rv1 on Line Rider - Full speed on the
ponpon on WinBtrfs - The Windows driver
fabien on HortusFox - The shared logbook
Make payments with PayPal
Emplacement d'échange de liens — reconstitution
DokuWiki - A critical flaw to
NTLite - Clean up Windows befo
Line Rider - Full speed on the
Use Paypal to donate Utiliser Paypal pour faire un don
Use Allopass to donate Utilisez Allopass pour faire un don
starfix! dans DokuWiki - A critical flaw to
Morgane dans NTLite - Clean up Windows befo
ts3rv1 dans Line Rider - Full speed on the
ponpon dans WinBtrfs - The Windows driver
fabien dans HortusFox - The shared logbook
Annonces contextuelles
korben.info (c) 2004/2008 | Liens | Flux RSS des articles