CVE-2026-103044

Awaiting Analysis Awaiting Analysis - Queue

XML Injection in MediaWiki EasyTimeline Extension

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: wikimedia-foundation

Description

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103044

EUVD

EUVD-2026-89480

Affected Vendors & Products

Vendor	Product	Version / Range
the_wikimedia_foundation	mediawiki_easy_timeline_extension	to 1.46.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-91	The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML injection, specifically a blind XPath injection, in the Wikimedia Foundation MediaWiki EasyTimeline extension. It allows attackers to inject malicious XML code into the application, potentially altering its behavior or extracting sensitive data.

Detection Guidance

Detection of XML injection vulnerabilities like this one typically involves inspecting web application logs for unusual XML input patterns, testing input fields with XML payloads, and monitoring for errors related to XML parsing. No specific commands are provided in the given context.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized data access, modification of timeline data, or disruption of MediaWiki functionality. Users relying on the EasyTimeline extension for visual data representation could be affected.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (if personal data is exposed) or HIPAA (if protected health information is compromised). Organizations using the affected extension must address it to maintain compliance.

Mitigation Strategies

Update the Mediawiki EasyTimeline extension to version 1.46.1 or later if using 1.46.x, 1.45.5 or later if using 1.45.x, or 1.43.10 or later if using 1.43.x to address the XML injection vulnerability.

Hi! I’m here to help you understand CVE-2026-103044. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70