XML Injection Vulnerability in Wikimedia Foundation Mediawiki's EasyTimeline Extension

CVE-2026-103044

What is CVE-2026-103044?

The EasyTimeline extension for Mediawiki has a vulnerability that allows an attacker to execute XML injection attacks, also known as blind XPath injection. This flaw can potentially lead to unauthorized access to sensitive data or manipulation of data returned by the application. Versions prior to 1.46.1, as well as 1.45.5 and 1.43.10, are particularly at risk. It is crucial for users to be aware of this vulnerability and apply necessary updates to mitigate potential exploitation.

References