Executive brief
A vulnerability in DokuWiki, a popular open-source wiki software, allows remote attackers to crash the server or make it unresponsive. By sending a specially crafted file upload request, an attacker can force the server to create thousands of nested folders, exhausting its processing power. This results in a denial of service, preventing legitimate users from accessing the wiki.
Technical details
An unauthenticated denial of service (DoS) vulnerability exists in DokuWiki's media upload functionality within 'inc/media.php'. The 'media_upload_xhr()' function fails to validate the directory depth of the 'qqfile' parameter, which is used as a file identifier. Because DokuWiki interprets colons (:) as directory separators, an attacker can provide a filename containing a large number of colons (e.g., '123:123:...:123.pdf'). This forces the server to recursively create deeply nested directory structures, leading to CPU exhaustion and filesystem resource depletion. The attack can be performed remotely without authentication via a POST request to 'lib/exe/ajax.php'.
Affected products
- DokuWiki DokuWiki 2025-05-14b "Librarian" [56.2]
Timeline
- 2026-01-09: disclosed: Vulnerability details shared on GitHub by researcher Hebing123
- 2026-04-03: advisory: CVE published and initial CISA-ADP assessment provided