Fedora has published a resolution advisory for DokuWiki on Fedora 44 that backports a fix for a critical unauthenticated code execution flaw described as an object injection issue in the upstream DokuWiki project. The source advisory is intentionally terse: it points to the upstream DokuWiki issue at https://github.com/dokuwiki/dokuwiki/issues/4752 and identifies the Fedora update as FEDORA-2026-9bbb604ea2. No CVE identifier or CVSS score is provided in the news summary, and defenders should not invent one. Operationally, however, the combination of DokuWiki, unauthenticated reachability, object injection, and code execution is enough to treat this as a priority internet-facing web application remediation.
The affected population is straightforward: Fedora 44 systems running the DokuWiki package before the fixed advisory build, especially instances exposed directly to the internet or reachable from low-trust user networks. DokuWiki is frequently deployed for internal documentation, homelabs, small team knowledge bases, and lightweight public wikis. Those are exactly the kinds of systems that get forgotten after initial setup, run under a broad PHP stack, and sit adjacent to credentials, runbooks, network diagrams, incident notes, and administrative documentation. If an attacker can execute code as the web server or PHP-FPM user, the immediate impact is web content tampering and webshell deployment; the secondary impact is theft of wiki contents, configuration secrets, cached credentials, and lateral movement into whatever that host can reach.
What happened
The Fedora 44 advisory resolves a DokuWiki package update that backports an upstream fix for a critical object injection flaw leading to unauthenticated code execution. Object injection in PHP applications generally means attacker-controlled input reaches an unsafe deserialization path, allowing an attacker to influence object creation or magic method behavior in a way that becomes file write, template inclusion, or command execution. The public summary does not include a working exploit, a proof of concept, indicators of compromise, confirmation of active exploitation, or a CISA Known Exploited Vulnerabilities listing. That absence should not be read as safety. It means the defensive action is driven by exposure and exploitability rather than by confirmed mass exploitation.
For defenders, the important facts are:
- Platform: Fedora 44 package builds of DokuWiki prior to the fixed update referenced by FEDORA-2026-9bbb604ea2.
- Application class: PHP wiki application commonly served by Apache httpd or nginx with PHP-FPM.
- Attack surface: unauthenticated HTTP requests to DokuWiki routes, plugins, templates, or handlers that process user-controlled serialized or object-like input.
- Impact: code execution in the context of the web server or PHP-FPM service account, followed by persistence through PHP files, cron jobs, systemd user units, modified templates, or poisoned wiki pages.
- Current exploitation status from the source item: not stated. Treat reachable DokuWiki as potentially targetable until patched and verified.
The urgency is highest for any DokuWiki instance that is internet-facing, reachable through a reverse proxy, hosted on a VPS, integrated with SSO or LDAP, or used to store operational material. Internal-only instances still matter because wikis often hold high-value reconnaissance data and are trusted by administrators during incidents.
Technical analysis
The vulnerability class is object injection leading to code execution. In PHP ecosystems, the defender-relevant mental model is not a single magical payload; it is a chain. An unauthenticated client sends crafted HTTP input to a DokuWiki endpoint. Somewhere in the request lifecycle, attacker-controlled data is deserialized or instantiated in an unsafe way. PHP object behavior is then abused through destructor, wakeup, toString, or similar object lifecycle paths to trigger a dangerous operation such as writing a file, including a template, invoking a callable, or executing a system command. The final primitive is typically code running as apache, nginx, php-fpm, or the local web user.
From a blue team perspective, focus on the observable edges of that chain rather than trying to signature an unknown serialized blob:
- An HTTP request reaches DokuWiki over 80/443 or through a reverse proxy.
- The web tier hands execution to PHP via Apache mod_php, php-fpm, or a CGI-like path.
- PHP code under the DokuWiki installation processes attacker-controlled input and hits the vulnerable object path.
- A suspicious follow-on action occurs: creation of a PHP file in a writable data or plugin directory, modification of template or plugin code, spawning of a shell, outbound curl/wget retrieval, or execution of Python/Perl/bash by a web process.
- Persistence is established by dropping a webshell, adding a rogue plugin, altering local.php or users.auth.php, planting cron entries, or modifying systemd units if file permissions are weak.
Affected components to inventory include the DokuWiki package itself, enabled plugins, templates, farm configurations if used, and the PHP runtime. Fedora packaging can place content under paths such as /usr/share/dokuwiki, /etc/dokuwiki, /var/lib/dokuwiki, or /var/www/dokuwiki depending on local layout. Your detection and file integrity monitoring should be based on the actual DocumentRoot and DokuWiki data directory, not assumed paths.
There is no CVE in the provided advisory summary and no CVSS score to cite. Do not downgrade the issue because the advisory lacks a formal identifier. A critical unauthenticated code execution fix in a web application is enough to drive same-week change control for internet-exposed systems and a scheduled patch for internal systems after backup and compatibility checks.
Detection and response
Use these detections as hunting logic, not as blind always-on blockers. The highest-fidelity signal is a web server or PHP-FPM worker spawning an interactive shell, a downloader, or an interpreter that is not part of normal DokuWiki operation. The second signal is creation of PHP files in writable DokuWiki data, cache, plugin, or template locations by the web process. Tune paths to your deployment before enabling alerting broadly.
---
title: Linux Web Server or PHP-FPM Spawning Shell Downloader or Interpreter
tid: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects DokuWiki web tier processes spawning shells, downloaders, or script interpreters consistent with post-exploitation after unauthenticated PHP object injection.
references:
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.command_and_control
- attack.t1059
- attack.t1105
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/httpd'
- '/apache2'
- '/nginx'
- '/php-fpm'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/perl'
- '/php'
condition: selection_parent and selection_child
falsepositives:
- Package maintenance scripts executed during approved updates
- Administration performed through web-based management plugins during change windows
level: high
---
title: PHP File Created in DokuWiki Writable Directories by Web Process
tid: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects creation of PHP files under DokuWiki data, cache, plugin, template, or upload paths by web-tier processes, a common webshell or persistence artifact after PHP code execution.
references:
- https://attack.mitre.org/techniques/T1505/003/
- https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.defense_evasion
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|endswith:
- '/httpd'
- '/apache2'
- '/nginx'
- '/php-fpm'
selection_path:
TargetFilename|contains:
- '/dokuwiki/data/'
- '/dokuwiki/lib/plugins/'
- '/dokuwiki/lib/tpl/'
- '/dokuwiki/conf/'
- '/var/lib/dokuwiki/'
- '/var/www/dokuwiki/'
- '/usr/share/dokuwiki/'
selection_ext:
TargetFilename|endswith:
- '.php'
- '.phtml'
- '.phar'
condition: selection_process and selection_path and selection_ext
falsepositives:
- Legitimate plugin or template installation during approved maintenance
- Distribution package operations writing PHP files; correlate with dnf or rpm transaction timing
level: medium
// Hunt Linux web-tier process chains and DokuWiki PHP file artifacts in Sentinel/Defender.
let suspicious_children = dynamic(['sh','bash','dash','zsh','curl','wget','python','python3','perl','php']);
union isfuzzy=true
(Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ('httpd','apache2','nginx','php-fpm') or SyslogMessage has_any ('httpd','apache2','nginx','php-fpm')
| where SyslogMessage has_any ('/bin/sh','/bin/bash','/usr/bin/curl','/usr/bin/wget','python3','/usr/bin/perl','/usr/bin/php')
| project TimeGenerated, Computer, ProcessName, SyslogMessage, Facility, SeverityLevel),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ('httpd','apache2','nginx','php-fpm')
| where FileName in~ (suspicious_children)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, AccountName),
(DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ('httpd','apache2','nginx','php-fpm')
| where FolderPath has_any ('dokuwiki/data','dokuwiki/lib/plugins','dokuwiki/lib/tpl','dokuwiki/conf','var/lib/dokuwiki','var/www/dokuwiki','usr/share/dokuwiki')
| where FileName endswith '.php' or FileName endswith '.phtml' or FileName endswith '.phar'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType, SHA256)
| sort by TimeGenerated desc
-- Hunt for suspicious web-tier child processes and PHP files dropped into DokuWiki-writable paths.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)httpd|apache2|nginx|php-fpm' OR Exe =~ '(?i)httpd|apache2|nginx|php-fpm')
OR CommandLine =~ '(?i)/bin/(sh|bash|dash)|/usr/bin/(curl|wget|python3|perl|php)'
SELECT FullPath, Size, Mtime, Ctime, IsDir
FROM glob(globs=['/var/www/dokuwiki/**/*.php','/var/lib/dokuwiki/**/*.php','/usr/share/dokuwiki/lib/plugins/**/*.php','/usr/share/dokuwiki/lib/tpl/**/*.php','/etc/dokuwiki/**/*.php'])
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC
# Fedora 44 DokuWiki patch, verification, and triage script. Run on the DokuWiki host after snapshot/backup.
set -euo pipefail
printf '%s
' '== Current DokuWiki package and advisory state =='
rpm -q dokuwiki || true
dnf list --showduplicates dokuwiki 2>/dev/null | tail -n 20 || true
dnf updateinfo info --advisory FEDORA-2026-9bbb604ea2 2>/dev/null || true
printf '%s
' '== Apply the Fedora fixed build =='
dnf upgrade -y --advisory FEDORA-2026-9bbb604ea2
rpm -q dokuwiki
printf '%s
' '== Restart web and PHP services safely =='
systemctl list-units --type=service --state=running | grep -E 'httpd|apache2|nginx|php-fpm' || true
systemctl try-restart php-fpm 2>/dev/null || true
systemctl try-restart httpd 2>/dev/null || true
systemctl try-restart nginx 2>/dev/null || true
printf '%s
' '== Find recent PHP files in DokuWiki-writable locations =='
for d in /var/www/dokuwiki /var/lib/dokuwiki /usr/share/dokuwiki /etc/dokuwiki; do
if [ -d "$d" ]; then
find "$d" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM:%TS %u:%g %m %p\n' 2>/dev/null | sort
fi
done
printf '%s
' '== Review suspicious web child processes and logs =='
journalctl --since '14 days ago' -u httpd -u nginx -u php-fpm --no-pager 2>/dev/null | grep -Ei 'sh -c|bash -c|curl |wget |python3|perl |php |unserialize|object|dokuwiki' | tail -n 200 || true
last -a | head -n 30 || true
printf '%s
' '== Optional: verify DokuWiki is not writable by the runtime user outside approved paths =='
for d in /var/www/dokuwiki /var/lib/dokuwiki /usr/share/dokuwiki /etc/dokuwiki; do
if [ -d "$d" ]; then
find "$d" -type d -writable -printf '%m %u:%g %p\n' 2>/dev/null | head -n 100
fi
done
Remediation and hardening
Patch first, then prove the patch landed. On Fedora 44, apply the fixed DokuWiki build referenced by FEDORA-2026-9bbb604ea2 with dnf upgrade --advisory FEDORA-2026-9bbb604ea2, then confirm the installed NEVRA with rpm -q dokuwiki and confirm the service was restarted so PHP-FPM or Apache is not still running an old opcache or worker pool. Because the source summary does not publish a fixed package version number, do not claim a specific version in change tickets unless you read it from rpm or Bodhi on the host. Use the Fedora update page for FEDORA-2026-9bbb604ea2, the LinuxSecurity advisory mirror, and the upstream DokuWiki issue 4752 as references in the ticket.
If the wiki is internet-facing and patching cannot happen immediately, take it offline or place it behind an allowlist/VPN until patched. A WAF rule for generic serialized PHP markers can create false confidence and false positives; prefer temporary network restriction, authentication in front of the wiki, disabling public registration, and read-only filesystem permissions for code and conf paths. If compromise is suspected, preserve evidence before cleanup: capture package state, web logs, PHP-FPM logs, auth logs, journald, DokuWiki data directories, recently modified PHP files, crontabs, systemd units, and running processes. Rebuild is safer than surgical cleaning for any host that shows webshell artifacts, unexpected outbound downloads, new local users, modified users.auth.php, or web-tier child shells.
After patching, validate application function and reduce future blast radius. Run DokuWiki under a dedicated low-privilege account. Ensure the web runtime can write only to required data/cache/upload paths and cannot write to code, plugin, template, or configuration directories. Disable unused plugins and templates, remove old installs, enforce HTTPS, restrict admin and installer routes, enable rate limiting at the reverse proxy, centralize Apache/nginx and PHP-FPM logs into Sentinel or your SIEM, and add file integrity monitoring for PHP under DokuWiki-writable paths. Finally, inventory every DokuWiki instance, including forgotten VMs and containers, because the next advisory will not wait for asset discovery.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.