CVE-2026-26477: 
NixOS vulnerability analysis and mitigation

CVE-2026-26477 is an unauthenticated Denial of Service (DoS) vulnerability in DokuWiki version 2025-05-14b "Librarian" [56.2], caused by improper handling of the qqfile parameter in the media_upload_xhr() function within inc/media.php. A remote attacker can exploit this flaw without authentication to exhaust server CPU resources by triggering recursive creation of deeply nested directory structures. The vulnerability was disclosed on April 3, 2026, and affects only the 2025-05-14b release. The CVSS v3.1 base score varies by source: NVD/Feedly assigns 4.3 (Medium) with low-privilege requirement, while the GitHub Advisory Database rates it 7.5 (High) as unauthenticated (Github Advisory, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400, CWE-770) combined with improper path handling (CWE-22) in the media_upload_xhr() function. DokuWiki interprets colon characters (:) in the qqfile GET parameter as directory separators when constructing file paths — for example, qqfile=a:b:c.pdf results in the creation of nested directories a/b/c.pdf. An attacker can craft a request with 1,000 or more colons in the filename (e.g., qqfile=1:1:1:...:1.pdf), forcing the server to recursively create hundreds or thousands of nested directories, causing CPU exhaustion. The vulnerable code passes the unsanitized qqfile input directly to media_save() without validating directory depth or imposing any resource limits (GitHub Issue, Github Advisory).

Successful exploitation causes CPU exhaustion on the DokuWiki server, blocking all legitimate user requests and rendering the wiki platform unavailable. The impact is limited to availability — there is no confidentiality or integrity impact, and no data exfiltration is possible through this vulnerability. Because the attack requires no authentication, any internet-facing DokuWiki instance running version 2025-05-14b is at risk of being taken offline by a single attacker with minimal resources (GitHub Issue, Github Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional public proof-of-concept exploit code is available beyond the researcher's issue report describing the attack technique. The EPSS score is approximately 0.059–0.107%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and low complexity, making it trivially reproducible by any attacker familiar with the disclosed technique (GitHub Issue, Github Advisory).

1. Reconnaissance: Identify internet-facing DokuWiki instances running version 2025-05-14b "Librarian" using search engines (Shodan, Censys) or by checking the DokuWiki version string in page footers or VERSION files.
2. Identify the vulnerable endpoint: Target the media upload AJAX endpoint at /lib/exe/ajax.php with the call=mediaupload parameter, which invokes media_upload_xhr().
3. Craft the malicious request: Construct a POST request with a qqfile parameter containing a large number of colon-separated segments (e.g., qqfile=1:1:1:1:...:1.pdf with 1,000+ colons) to force creation of deeply nested directories.
4. Send the request: Submit the crafted POST request — no authentication is required. Example:

POST /lib/exe/ajax.php?tab_files=files&tab_details=view&do=media&ns=&call=mediaupload&qqfile=1:1:1:[...repeat 1000x...]:1.pdf HTTP/1.1
Host: target-ip
Content-Length: 5

12344

5. Achieve DoS: The server attempts to recursively create 1,000+ nested directories, exhausting CPU resources and causing the DokuWiki instance to become unresponsive to legitimate requests. Repeat requests amplify the effect (GitHub Issue).

• Network: Repeated POST requests to /lib/exe/ajax.php with call=mediaupload and an unusually long qqfile parameter containing many colon characters; high request rate from a single source IP to the media upload endpoint.
• File System: Presence of deeply nested empty directory structures (hundreds or thousands of levels) within the DokuWiki data/media directory, created in rapid succession.
• Logs: Web server access logs showing POST requests to /lib/exe/ajax.php?...call=mediaupload&qqfile= with extremely long parameter values (hundreds to thousands of characters consisting of repeated colon-separated segments).
• Process/System: Sudden spike in CPU utilization on the web server process (PHP/Apache/Nginx) coinciding with media upload requests; server becoming unresponsive or slow to respond to all requests (GitHub Issue).

No official patch from the DokuWiki project specifically addressing CVE-2026-26477 has been publicly confirmed at this time; the GitHub Advisory Database lists patched versions as "Unknown" (Github Advisory). Recommended interim mitigations include: (1) restricting access to /lib/exe/ajax.php with call=mediaupload to authenticated users only via web server configuration; (2) implementing rate limiting on the media upload endpoint; (3) deploying a WAF rule to block requests where the qqfile parameter contains an excessive number of colon characters; (4) disabling media uploads entirely if not required; and (5) monitoring application and web server logs for anomalous upload activity. Administrators should monitor the DokuWiki releases page for a patched version and apply it promptly when available.

Red Hat tracked the vulnerability via Bugzilla (Bug 2454789) and assigned it high severity/priority, though no Red Hat products are directly affected (Red Hat Bugzilla). The GitHub Advisory Database published the advisory on April 3, 2026, rating it High severity (Github Advisory). German security news outlet Pro-Linux.de covered the vulnerability, and Tenable added detection via Nessus plugin 311101. Community reaction has been limited, with no major vendor statements or widespread media coverage observed.