CVE-2026-103044 - Vulnerability Details - OpenCVE

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Wikimedia	Mediawiki - Easytimeline Extension

No data.

No data.

References

Link	Providers
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078
https://phabricator.wikimedia.org/T428006

History

Thu, 01 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-22
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 30 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki - Easytimeline Extension
Vendors & Products		Wikimedia Wikimedia mediawiki - Easytimeline Extension

Tue, 29 Sep 2026 23:00:00 +0000

Type	Values Removed	Values Added
Description		XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
Title		EasyTimeline should not serve image maps as application/xml
Weaknesses		CWE-91
References		https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078 https://phabricator.wikimedia.org/T428006

MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published: 2026-09-29T22:46:46.214Z

Updated: 2026-10-01T18:44:17.206Z

Reserved: 2026-09-29T22:29:32.001Z

Link: CVE-2026-103044

Vulnrichment

Updated: 2026-10-01T18:29:15.832Z

NVD

Status : Awaiting Analysis

Published: 2026-09-29T23:17:22.190

Modified: 2026-10-01T19:17:17.750

Link: CVE-2026-103044

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103044", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-09-29T22:29:32.001Z", "datePublished": "2026-09-29T22:46:46.214Z", "dateUpdated": "2026-10-01T18:44:17.206Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:54:47.454Z"}, "title": "EasyTimeline should not serve image maps as application/xml", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-91", "description": "CWE-91 XML injection (aka blind XPath injection)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "affected": [{"product": "Mediawiki - EasyTimeline extension", "repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/timeline/+/refs/heads/master", "versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected", "vendor": "The Wikimedia Foundation"}], "descriptions": [{"lang": "en", "value": "XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.\n\nThis issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.<p>This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.</p>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T428006", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078", "tags": ["mitigation"]}], "credits": [{"lang": "en", "value": "SomeRandomDeveloper", "type": "finder"}, {"lang": "en", "value": "Scott Bassett", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T18:43:10.732829Z", "id": "CVE-2026-103044", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T18:44:17.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T18:43:10.732829Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T18:29:15.832Z"}}], "cna": {"title": "EasyTimeline should not serve image maps as application/xml", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}, {"lang": "en", "type": "remediation developer", "value": "Scott Bassett"}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "affected": [{"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/timeline/+/refs/heads/master", "vendor": "The Wikimedia Foundation", "product": "Mediawiki - EasyTimeline extension", "versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T428006", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078", "tags": ["mitigation"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.\n\nThis issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "value": "XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.<p>This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-91", "description": "CWE-91 XML injection (aka blind XPath injection)"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:54:47.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103044", "state": "PUBLISHED", "dateUpdated": "2026-10-01T18:44:17.206Z", "dateReserved": "2026-09-29T22:29:32.001Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-09-29T22:46:46.214Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}