CVE-2026-103044

EasyTimeline should not serve image maps as application/xml

Published: —
Last modified: —
Status: published
Known exploitation: Not listed in CISA KEV
Fix: Fixed in 1.46.1, 1.45.5, 1.43.10
Public exploit: None on Exploit-DB

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total

Decision points from CISA's Vulnrichment, assessed — (SSVC 2.0.3).

Summary

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

Affected versions

The Wikimedia Foundation Mediawiki - EasyTimeline extension
fixed in 1.46.1, 1.45.5, 1.43.10

EasyTimeline should not serve image maps as application/xml

Summary

Affected versions

References 2

phabricator.wikimedia.org

gerrit.wikimedia.org