CVE-2026-26477 Denial of service in DokuWiki

What is CVE-2026-26477?

CVE-2026-26477 is a medium-severity denial of service vulnerability in DokuWiki, published on 3 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file

Weakness: CWE-400, CWE-770

Which versions are affected by CVE-2026-26477?

It affects 1 product.

Products include Dokuwiki Dokuwiki.

How do I fix CVE-2026-26477?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-26477 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26477 exists.

Other vulnerabilities in DokuWiki

• CVE-2018-15474 Code injection in n/a Critical 9.6
• CVE-2009-1960 Code injection in n/a Critical 9.3
• CVE-2016-7964 Server-side request forgery in n/a High 8.6
• CVE-2010-0288 Missing authorization in n/a High 7.5
• CVE-2019-25338 Dokuwiki 2018-04-22b - Username Enumeration Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-26477, GHSA-gwpq-c4hc-7qhj, UBUNTU-CVE-2026-26477.