CVE-2026-103044

Received Received - Intake

XML Injection in MediaWiki EasyTimeline Extension

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: wikimedia-foundation

Description

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-103044

EUVD

EUVD-2026-89480

Affected Vendors & Products

Vendor	Product	Version / Range
the_wikimedia_foundation	mediawiki_easy_timeline_extension	to 1.46.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-91	The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML injection, specifically a blind XPath injection, in the Wikimedia Foundation MediaWiki EasyTimeline extension. It allows attackers to inject malicious XML code into the application, potentially altering its behavior or extracting sensitive data.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized data access, modification of timeline data, or disruption of MediaWiki functionality. Users relying on the EasyTimeline extension for visual data representation could be affected.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (if personal data is exposed) or HIPAA (if protected health information is compromised). Organizations using the affected extension must address it to maintain compliance.

Mitigation Strategies

Update the Mediawiki EasyTimeline extension to version 1.46.1 or later if using 1.46.x, 1.45.5 or later if using 1.45.x, or 1.43.10 or later if using 1.43.x to address the XML injection vulnerability.

Hi! I’m here to help you understand CVE-2026-103044. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70