CVE-2026-26477
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Dokuwiki version 2025-05-14b has a denial of service vulnerability in the media_upload_xhr() function in media.php. A remote attacker can cause a denial of service.
Risk Assessment
An attacker can crash the Dokuwiki service, disrupting access to documentation and team collaboration.
Recommendation
Update Dokuwiki to a version that includes a fix for this vulnerability.
Other vulnerabilities in Dokuwiki
See all- CVE-2026-37106Critical
In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.
- CVE-2023-34408Medium
DokuWiki before version 2023-04-04a allows XSS via RSS titles.
Original NVD description (English source)
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
Vulnerability data from NVD (NIST) · CISA KEV · EPSS