CVE-2026-26477: Dokuwiki DOS Vulnerability

CVE-2026-26477 Overview

CVE-2026-26477 is a Denial of Service (DoS) vulnerability affecting DokuWiki v.2025-05-14b "Librarian" [56.2]. The vulnerability exists within the media_upload_xhr() function in the media.php file, allowing a remote attacker with low privileges to cause service disruption through resource exhaustion.

Critical Impact

Authenticated attackers can remotely disrupt DokuWiki availability by exploiting improper resource allocation in the media upload functionality.

Affected Products

• DokuWiki v.2025-05-14b "Librarian" [56.2]
• DokuWiki instances with media upload functionality enabled

Discovery Timeline

• 2026-04-03 - CVE-2026-26477 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-26477

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). The flaw resides in how the media_upload_xhr() function processes incoming media upload requests without adequate resource management controls.

When exploited, the vulnerability allows an attacker with authenticated access to the DokuWiki instance to trigger resource exhaustion conditions. The attack vector is network-based, requiring only low privileges to execute. While the confidentiality and integrity of the system remain unaffected, the availability impact allows attackers to degrade or disrupt service for legitimate users.

Root Cause

The root cause stems from insufficient validation and resource throttling in the media_upload_xhr() function within media.php. The function fails to properly limit resource allocation during XHR-based media upload operations, creating an exploitable condition where repeated or malformed requests can exhaust server resources.

Attack Vector

The attack is conducted over the network and requires authentication with low-level privileges. An attacker can exploit the media_upload_xhr() function by sending specially crafted upload requests that trigger resource exhaustion. The attack does not require user interaction and affects only the targeted DokuWiki instance.

The vulnerability manifests in the media upload handling mechanism. When processing XHR upload requests, the media_upload_xhr() function in media.php does not implement adequate resource limits, allowing an authenticated attacker to exhaust server resources through repeated or malformed requests. For additional technical details, see the GitHub Issue #94 Discussion.

Detection Methods for CVE-2026-26477

Indicators of Compromise

• Abnormal volume of POST requests to media.php or media upload endpoints
• Sudden spikes in server resource utilization (CPU, memory) correlated with media upload activity
• Multiple rapid authentication attempts followed by media upload requests from the same source
• Server logs showing repeated invocations of media_upload_xhr() function

Detection Strategies

• Monitor web server logs for unusual patterns in media upload requests to media.php
• Implement rate limiting detection on media upload endpoints to identify potential abuse
• Deploy application-layer monitoring to track resource consumption during upload operations
• Configure alerts for anomalous HTTP POST request volumes targeting DokuWiki media endpoints

Monitoring Recommendations

• Enable detailed logging for the DokuWiki media upload functionality
• Set up resource utilization thresholds and alerting for the web server hosting DokuWiki
• Monitor authenticated user sessions for abnormal media upload behavior patterns
• Review access logs periodically for repeated failed or suspicious upload attempts

How to Mitigate CVE-2026-26477

Immediate Actions Required

• Review and restrict access to media upload functionality to trusted users only
• Implement rate limiting on media upload endpoints at the web server or WAF level
• Monitor DokuWiki instances for signs of DoS exploitation attempts
• Consider temporarily disabling XHR-based media uploads if exploitation is detected

Patch Information

Check the GitHub DokuWiki Release Notes for updates and patches addressing this vulnerability. Organizations should monitor the DokuWiki project for security updates and apply patches as they become available.

Workarounds

• Implement web application firewall (WAF) rules to rate-limit requests to media.php
• Restrict media upload permissions to administrators or trusted users only
• Configure server-side resource limits for PHP processes handling media uploads
• Deploy reverse proxy rate limiting to protect the media upload endpoint

# Example: Rate limiting configuration for nginx
# Add to server or location block for DokuWiki
location ~ ^/lib/exe/media\.php {
    limit_req zone=dokuwiki_upload burst=5 nodelay;
    limit_req_status 429;
    # Additional security headers
    add_header X-Content-Type-Options "nosniff" always;
}