- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 25
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 7 excluded.
Web 1
- https://www.dokuwiki.org
Products and areas 10
- The ACL engine and the rules file it evaluates, which decides read, edit, create, upload and delete rights per namespace and per user or group
- The authentication plugin interface and the bundled backends, covering plain-file accounts, LDAP, Active Directory and the SQL backends
- The configuration manager and the installer, both of which write files that change how the wiki authenticates and authorises
- The media manager: upload handling, MIME and extension checking, storage layout and the routes that serve uploaded files back to a browser
- The page storage layer and the path handling that maps a page identifier to a file on disk, including the attic and meta directories
- The parser and renderer, covering the syntax layer, the instruction cache and the settings that allow raw HTML or PHP in page content
- The plugin and template manager, which downloads archives over the network and unpacks them into the installation
- The project publishes a list of what does not qualify rather than a positive scope statement, and asks for everything else by email to the maintainer. Anything in the DokuWiki tree that the non-qualifying list does not cover is inside that
- The search index and its incremental update path, where results can cross content the searcher cannot read
- The XML-RPC and JSON-RPC remote API, and the permission checks it applies compared with the web interface
Out of scope (7)
- AI-assisted findings submitted without the manual verification AI_POLICY.md requires
- Denial of service and performance issues, ruled out by name in the project's non-qualifying list
- Installation and deployment misconfiguration, including a data directory left inside the web root by the operator
- Server-side request forgery, which the project excludes on the stated grounds that intranet access is a deployment feature
- The behaviour of external software the wiki interacts with rather than a defect in DokuWiki itself
- Third-party plugins and templates from the plugin repository, which are separate projects with their own authors
- Upstream PHP and library defects, unless DokuWiki's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the maintainer at the address on the policy page .
-
Read the non-qualifying list before you start.
-
AI_POLICY.md requires that AI-assisted findings be manually verified before they are submitted
-
Test against a current release.
-
Use the canonical repository dokuwiki/dokuwiki .
-
Hold the detail until a patched release is out.
Not accepted
-
Denial of service and performance issues
-
Server-side request forgery
-
The behaviour of external software the wiki interacts with rather than a defect in DokuWiki itself
-
Installation and deployment misconfiguration, including a data directory left inside the web root by the operator
-
Third-party plugins and templates from the plugin repository
-
Upstream PHP and library defects, unless DokuWiki's own use of them is what makes the issue reachable
-
AI-assisted findings submitted without the manual verification AI_POLICY.md requires
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-26477 | An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file | Medium 4.3 | 3 Apr 2026 |
| CVE-2019-25338 | DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzing the server's error response messages. | Medium 6.9 | 12 Feb 2026 |
| CVE-2023-34408 | DokuWiki before 2023-04-04a allows XSS via RSS titles. | Medium 5.4 | 5 Jun 2023 |
| CVE-2022-3123 | Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a. | Medium 6.1 | 5 Sep 2022 |
| CVE-2022-28919 | HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename. | Medium 6.1 | 12 May 2022 |
| CVE-2018-15474 | CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki. | Critical 9.6 | 7 Sep 2018 |
| CVE-2017-18123 | The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs. | High 8.6 | 3 Feb 2018 |
| CVE-2017-12979 | DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution. | Medium 6.1 | 21 Aug 2017 |
| CVE-2017-12980 | DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as demonstrated by the dc:creator element. | Medium 6.1 | 21 Aug 2017 |
| CVE-2017-12583 | DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. | Medium 6.1 | 6 Aug 2017 |
| CVE-2016-7965 | DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the sa | Medium 6.5 | 31 Oct 2016 |
| CVE-2016-7964 | The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16. | High 8.6 | 31 Oct 2016 |
| CVE-2015-2172 | DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API. | Medium 6.5 | 30 Mar 2015 |
| CVE-2014-9253 | The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php. | Medium 4.3 | 17 Dec 2014 |
| CVE-2014-8761 | inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call. | Medium 5.0 | 22 Oct 2014 |
| CVE-2014-8762 | The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter. | Medium 5.0 | 22 Oct 2014 |
| CVE-2014-8763 | DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind. | Medium 5.0 | 22 Oct 2014 |
| CVE-2014-8764 | DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind. | Medium 5.0 | 22 Oct 2014 |
| CVE-2012-3354 | doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message. | Medium 4.3 | 20 Nov 2012 |
| CVE-2011-3727 | DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files. | Medium 5.0 | 23 Sep 2011 |
| CVE-2011-2510 | Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link. | Medium 4.3 | 14 Jul 2011 |
| CVE-2010-0287 | Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter. | Medium 5.0 | 15 Feb 2010 |
| CVE-2010-0288 | A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010. | High 7.5 | 15 Feb 2010 |
| CVE-2010-0289 | Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors. | Medium 6.8 | 15 Feb 2010 |
| CVE-2009-1960 | inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs. | High 9.3 | 8 Jun 2009 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview DokuWiki is a flat-file PHP wiki with no database behind it, so it lands on network appliances and inside corporate intranets that would rather not run MySQL for a documentation tool. W3Techs puts it at 22.5% of every wiki engine in use, second only to MediaWiki, and the linuxserver image alone carries 24 million pulls. The security model is the ACL file plus the media manager: page content and uploads both go straight to disk in a tree the web server is already serving. Nobody has ever published a GitHub advisory for it, and reports go to one maintainer by email for nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The project publishes a list of what does not qualify rather than a positive scope statement, and asks for everything else by email to the maintainer. Anything in the DokuWiki tree that the non-qualifying list does not cover is inside that The ACL engine and the rules file it evaluates, which decides read, edit, create, upload and delete rights per namespace and per user or group The authentication plugin interface and the bundled backends, covering plain-file accounts, LDAP, Active Directory and the SQL backends The media manager: upload handling, MIME and extension checking, storage layout and the routes that serve uploaded files back to a browser The page storage layer and the path handling that maps a page identifier to a file on disk, including the attic and meta directories The parser and renderer, covering the syntax layer, the instruction cache and the settings that allow raw HTML or PHP in page content The plugin and template manager, which downloads archives over the network and unpacks them into the installation The XML-RPC and JSON-RPC remote API, and the permission checks it applies compared with the web interface The configuration manager and the installer, both of which write files that change how the wiki authenticates and authorises The search index and its incremental update path, where results can cross content the searcher cannot read Out of scope Denial of service and performance issues, ruled out by name in the project's non-qualifying list Server-side request forgery, which the project excludes on the stated grounds that intranet access is a deployment feature The behaviour of external software the wiki interacts with rather than a defect in DokuWiki itself Installation and deployment misconfiguration, including a data directory left inside the web root by the operator Third-party plugins and templates from the plugin repository, which are separate projects with their own authors Upstream PHP and library defects, unless DokuWiki's own use of them is what makes the issue reachable AI-assisted findings submitted without the manual verification AI_POLICY.md requires Most-valued findings There is no CVE or advisory record to prioritise from, since the project has never used the GitHub advisory channel. Priorities below follow the trust boundaries the product actually has ACL bypass: reading, editing or uploading into a namespace the rules file gated. On an intranet wiki the restricted namespace is usually the reason the wiki was deployed Path traversal in the mapping from a page or media identifier to a file on disk, where a crafted identifier reads or writes outside the data tree Upload handling that puts a file somewhere the web server will execute, or that defeats the MIME and extension checks the media manager applies Stored cross-site scripting through the parser and renderer, including anywhere a syntax construct emits markup that escaped the sanitisation step The plugin and template manager, where a fetched or unpacked archive becomes code execution on the host Authentication backend defects, particularly an LDAP or SQL bind that accepts an identity or a password it should reject Anything unauthenticated, on an install base that overwhelmingly assumes a network boundary is doing the access control for it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email the maintainer at [email protected] . The policy also lists a GitHub issue and the mailing list, both of which are public, so email is the only private route Read the non-qualifying list before you start. Denial of service and performance issues, server-side request forgery, the behaviour of external software and installation misconfiguration are all ruled out by name Server-side request forgery specifically is closed by policy rather than by triage: the project states that reaching intranet resources is a feature for many deployments AI_POLICY.md requires that AI-assisted findings be manually verified before they are submitted Test against a current release. release-2026-07-14a shipped in July 2026 and the project ships on a steady cadence Use the canonical repository dokuwiki/dokuwiki . The old splitbrain/dokuwiki path redirects to it Disclosure Coordinated by email with the one maintainer who has run the project for two decades. Fixes ship in dated releases and the project publishes no GitHub advisories at all, so there is no GHSA to time an embargo against and no fixed day count to plan for. Hold the detail until a patched release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability