Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-103044: EasyTimeline extension can be tricked into processing bad XML
CVE-2026-103044 · published 19 days ago
Summary
The EasyTimeline add‑on for MediaWiki (versions before the latest releases) accepts XML data without proper checks. An attacker could insert specially crafted XML to read or change information behind the scenes. Update the EasyTimeline extension to the newest version to stop this risk.
What to do
- Update the wikimedia foundation mediawiki - easytimeline extension to version 1.46.1, 1.45.5, 1.43.10 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | the wikimedia foundation | mediawiki - easytimeline extension | < 1.46.1, 1.45.5, 1.43.10 |
| Ubuntu:18.04:LTS | canonical | mediawiki | All versions |
Original advisory text
EasyTimeline should not serve image maps as application/xml
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
References
- https://phabricator.wikimedia.org/T428006 Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-103044 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-103044 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-91XML Injection (aka Blind XPath Injection)
CWE-22Path Traversal
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta