CVE-2026-103044: the wikimedia foundation mediawiki - easytimeline extension
CVSS: 9.8v3.1CriticalAwaiting analysis
AliasesUBUNTU-CVE-2026-103044
Published 29-09-2026Last modified 01-10-2026
Vulnerability summary
CVE-2026-103044 is a critical (CVSS 9.8) vulnerability in the wikimedia foundation mediawiki - easytimeline extension. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.44%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 29-09-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
30-09-202621-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
The wikimedia foundation1 product
- mediawiki - easytimeline extension< 1.46.1, 1.45.5, 1.43.10
Ubuntu1 product
- mediawikiAll versions (No fix recorded)
2 vendors · 2 products