Cross-Site Scripting Vulnerability in Wikimedia Foundation Timeline
CVE-2026-58038

NONE

Key Information:

Vendor

Wikimedia Foundation

Status
Timeline
Vendor
CVE Published:
1 July 2026

What is CVE-2026-58038?

A cross-site scripting (XSS) vulnerability was identified in the timeline product of the Wikimedia Foundation. This issue arises from improper validation of user input during web page generation, potentially allowing attackers to inject malicious scripts. The vulnerability affects various versions of the timeline software, making it crucial for users to implement appropriate fixes to safeguard against potential exploits.

Affected Version(s)

timeline * < 1.46.0, 1.45.4, 1.44.6, 1.43.9

References

https://phabricator.wikimedia.org/T427611

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.