Remote Code Execution Vulnerability in DokuWiki by DokuWiki
CVE-2026-37106

9.8CRITICAL

Key Information:

Vendor

DokuWiki

Status
DokuWiki
Vendor
CVE Published:
30 June 2026

What is CVE-2026-37106?

A vulnerability in DokuWiki's 'Librarian' feature allows remote attackers to execute arbitrary code through the register function found in inc/auth.php. The exploit can be triggered without user authentication, making it critical for administrators to apply security updates and mitigate potential risks. This underscores the importance of maintaining software integrity and monitoring for vulnerabilities in web applications.

References

https://github.com/dokuwiki/dokuwiki
https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7e...
https://github.com/dokuwiki/dokuwiki/issues/4682

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.