# CVE-2026-26477: DokuWiki denial of service via directory traversal in media_upload_xhr

Source: https://junglewise.ai/threats/cve-2026-26477-dokuwiki-denial-of-service-via-directory-traversal-in-media  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-26477 · Severity: medium · CVSS 4.3 · Published 2026-04-03

A vulnerability in DokuWiki, a popular open-source wiki software, allows remote attackers to crash the server or make it unresponsive. By sending a specially crafted file upload request, an attacker can force the server to create thousands of nested folders, exhausting its processing power. This results in a denial of service, preventing legitimate users from accessing the wiki.

Technologies: [DokuWiki](https://junglewise.ai/threats/technologies/dokuwiki). Vendors: [DokuWiki](https://junglewise.ai/threats/vendors/dokuwiki).

## Quick answers

**Is CVE-2026-26477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26477 being exploited in the wild.

**How severe is CVE-2026-26477?** Medium severity, with a CVSS score of 4.3, published 3 April 2026.

**Which products and versions are affected?** DokuWiki 2025-05-14b "Librarian" [56.2].

**Is there a fix for CVE-2026-26477?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26477 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-26477?** Check whether you run DokuWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated denial of service (DoS) vulnerability exists in DokuWiki's media upload functionality within 'inc/media.php'. The 'media_upload_xhr()' function fails to validate the directory depth of the 'qqfile' parameter, which is used as a file identifier. Because DokuWiki interprets colons (:) as directory separators, an attacker can provide a filename containing a large number of colons (e.g., '123:123:...:123.pdf'). This forces the server to recursively create deeply nested directory structures, leading to CPU exhaustion and filesystem resource depletion. The attack can be performed remotely without authentication via a POST request to 'lib/exe/ajax.php'.

## Affected products

- DokuWiki DokuWiki 2025-05-14b "Librarian" [56.2]

## Timeline

- 2026-01-09: disclosed: Vulnerability details shared on GitHub by researcher Hebing123
- 2026-04-03: advisory: CVE published and initial CISA-ADP assessment provided

## References

- [https://github.com/Hebing123/cve/issues/94](https://github.com/Hebing123/cve/issues/94)
- [https://github.com/dokuwiki/dokuwiki/releases/tag/release-2025-05-14b](https://github.com/dokuwiki/dokuwiki/releases/tag/release-2025-05-14b)

## Related threats

- [DokuWiki PHP object injection in Draft::getDraftText()](https://junglewise.ai/threats/cve-2026-113356-dokuwiki-before-2026-07-14c-contains-a-php-object-injection)
- [DokuWiki incorrect access control in user registration function](https://junglewise.ai/threats/cve-2026-37106-dokuwiki-incorrect-access-control-in-user-registration-function)