Is there a patch available for CVE-2026-58038?

Yes, a patch is available for CVE-2026-58038. Update the affected software to the latest version immediately.

Wikimedia Timeline CVE-2026-58038

EUVD-2026-41022 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-pm32-8hr8-567h

PHP XSS Timeline Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

5.4 MEDIUM

Network-accessible stored XSS requiring low-privilege edit access (PR:L); victim must load the page (UI:R); scope change to other users' browser sessions with session theft potential (C:L/I:L).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:02 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline.

This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl.

This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Stored cross-site scripting in the Wikimedia Foundation Timeline extension exposes MediaWiki installations to session hijacking and credential theft. The flaw exists in Timeline.php and EasyTimeline.pl, where user-supplied timeline markup syntax is not properly neutralized before HTML output, allowing an authenticated wiki editor to inject arbitrary JavaScript executed in other users' browsers. No public exploit has been identified at time of analysis, and KEV listing is absent, but the network-accessible nature and low-privilege entry point make this a credible risk on publicly editable wikis.

Technical ContextAI

The Wikimedia Timeline extension (CPE: cpe:2.3:a:wikimedia_foundation:timeline:*:*:*:*:*:*:*:*) is a MediaWiki PHP/Perl extension that converts structured timeline syntax embedded in wiki pages into rendered graphical timelines. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the server-side processing pipeline spanning includes/Timeline.php and the Perl backend scripts/EasyTimeline.pl. User-controlled input passed through the timeline tag parser reaches HTML output without adequate escaping or sanitization, enabling injection of executable script content. Because this is stored in the wiki page, any visitor rendering the page triggers execution - the classic stored XSS pattern rather than reflected.

RemediationAI

Upgrade the Timeline MediaWiki extension to the patched releases: 1.43.9, 1.44.6, 1.45.4, or 1.46.0, selecting the branch that matches the deployed MediaWiki version. Details are available in the Wikimedia Phabricator task at https://phabricator.wikimedia.org/T427611. If an immediate upgrade is not feasible, the most effective compensating control is to disable the Timeline extension entirely in LocalSettings.php by commenting out or removing its registration - this eliminates the attack surface with no permanent data loss, though timeline functionality will be unavailable to all users. Alternatively, restricting wiki editing permissions to trusted users (disabling anonymous and open self-registration editing) raises the effective attack bar to authenticated contributors only, reducing but not eliminating risk. Input sanitization cannot be reliably patched at the configuration layer for this class of flaw without the vendor fix.