No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record
Identify whether your DokuWiki is running version v.2025-05-14b “Librarian” [56.2].
Check whether DokuWiki’s media upload/XHR upload feature is reachable from the internet in your setup (public access to the wiki and its upload endpoints).
If you are affected, restrict access to the wiki from the internet (for example, allow only your office/VPN IPs or use a reverse proxy with tight access rules).
Watch for an official DokuWiki update that addresses CVE-2026-26477 and upgrade immediately when a fixed version is published.
Ensure you have protections in place to blunt malicious requests (rate limiting / request filtering at your web server or reverse proxy).
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
In plain language
Written by AI from the record
A vulnerability in DokuWiki’s “Librarian” upload feature lets a remote attacker trigger denial-of-service with a crafted request; small businesses should review exposure and plan an upgrade, but there’s no known public fix yet.
In DokuWiki v.2025-05-14b “Librarian” [56.2], remote attackers can trigger a denial of service by sending a malicious request that abuses the media_upload_xhr() function in media.php; exploitation requires low effort and no user interaction.
If you're affected
Website downtime for users
Login or page access disruption
Service instability during attacks
What is it
Think of DokuWiki as your business’s online knowledge base. This bug targets the part that handles media uploads; an attacker can send a special request that makes the system struggle, leading to downtime or broken access. It’s like someone repeatedly poking a specific button until the whole kiosk freezes.
Who is affected
This matters if you run DokuWiki version v.2025-05-14b “Librarian” [56.2], especially where the wiki is reachable from the internet. Because the problem is triggered by remote requests and requires low attacker effort with no user interaction, you don’t need an employee to click anything for impact. The risk depends on whether the vulnerable upload functionality/endpoint is reachable from the network in your deployment (exact reachability is not yet known from the findings).
How urgent is it
This is an AMBER issue because attackers can trigger a denial of service remotely using crafted requests, and there’s growing press attention around it. Even though there’s no public exploit code and no KEV entry listed, availability problems can still cause real business disruption quickly if the vulnerable feature is reachable. Treat this as a priority to assess exposure and prepare mitigations while you wait for an official fix.
What to do — in detail
Confirm whether you’re exposed
Check your exact DokuWiki version and confirm whether it is v.2025-05-14b “Librarian” [56.2].
Confirm internet exposure: verify whether your DokuWiki (and specifically media upload/XHR upload requests) can be reached from the public internet.
Look for signs of request abuse: review web server access logs for bursts hitting media/upload-related endpoints and any related error logs showing failures or timeouts.
Mitigate immediately (while no fixed version is known)
Restrict access: if practical, limit access to the wiki from the internet (IP allowlisting for office/VPN, or restricting access at your reverse proxy/WAF).
Rate-limit and filter: enable rate limiting on the endpoints that handle media upload/XHR uploads, and block suspicious request patterns.
Harden the public surface: if you don’t need public editing/uploading, ensure those capabilities are disabled or tightly controlled.
Upgrade plan
Wait for an official DokuWiki update that specifically resolves CVE-2026-26477. As of the findings, no fix/patch information is available, so you can’t safely jump to a “known fixed” version yet.
When a fix is published, upgrade to the first fixed release on the vendor’s timeline, and validate that upload functionality still works normally.
What to monitor
After applying mitigations, monitor for ongoing spikes in traffic to the media upload handler, rising error rates, and user-reported downtime.
Technical context
CVE-2026-26477 is a denial-of-service issue in DokuWiki v.2025-05-14b “Librarian” [56.2]. The findings identify remote attackers being able to trigger the problem by sending a malicious request that abuses media_upload_xhr() in media.php. Preconditions and exact reachability conditions are not fully known from the findings (marked unknown), but the attack is network-based with low attacker effort and no user interaction.
Exploitation status: no KEV listing and no public exploit code on record. A prediction tool lists low predicted likelihood (do not rely on this for prioritization); traffic/interest is increasing in press attention.
Weakness mapping from findings: CWE-770 (allocation without limits / resource exhaustion) and CWE-400 (uncontrolled resource consumption). Severity is “Medium” by the provided CVSS, but for small businesses the operational risk is primarily availability impact (service disruption).
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
