DokuWiki vulnerabilities

In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.

Dokuwiki version 2025-05-14b has a denial of service vulnerability in the media_upload_xhr() function in media.php. A remote attacker can cause a denial of service.

DokuWiki before version 2023-04-04a allows XSS via RSS titles.