Is there a public PoC exploit available for EUVD-2026-41023?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41023. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-41023?

Yes, a patch is available for EUVD-2026-41023. Update the affected software to the latest version immediately.

Wikimedia Timeline EUVD-2026-41023

| CVE-2026-8857 NONE

Code Injection (CWE-94)

2026-07-01 wikimedia-foundation

GHSA-q6xp-j96f-7vmp

PHP RCE Code Injection Timeline Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

9.9 CRITICAL

Network-delivered code injection by low-privilege editors achieving server-side RCE constitutes full scope change with high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 15:51 vuln.today

DescriptionCVE.org

A vulnerability in Wikimedia Foundation timeline.

This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php.

This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Code injection in the Wikimedia Foundation Timeline extension (EasyTimeline) allows authenticated wiki editors to execute arbitrary server-side code via crafted timeline syntax processed by the Perl-based EasyTimeline.Pl script and its PHP integration layer Timeline.Php. The vulnerability stems from CWE-94 improper code generation control, where user-supplied timeline markup is passed to the backend Perl interpreter without sufficient sanitization, enabling remote code execution on the MediaWiki server. No public exploit code has been identified at time of analysis, but the RCE tag and network-accessible attack vector make this a high-priority patching target for any publicly editable or semi-public MediaWiki instance.

Technical ContextAI

The Wikimedia Timeline extension integrates EasyTimeline, a Perl rendering engine (scripts/EasyTimeline.Pl), with MediaWiki's PHP layer (includes/Timeline.Php). When a page containing <timeline> syntax is rendered, Timeline.Php passes user-supplied wikitext parameters to the EasyTimeline Perl script for server-side execution. CWE-94 (Improper Control of Generation of Code - Code Injection) identifies the root cause: user-controlled input is incorporated into dynamically generated or executed code without proper neutralization. In the EasyTimeline context, this likely means timeline directive parameters are unsafely interpolated into Perl execution paths - potentially via system calls, eval constructs, or unsanitized Perl string expansion - allowing injected payloads to escape the expected data context and execute as code. The CPE cpe:2.3:a:wikimedia_foundation:timeline:*:*:*:*:*:*:*:* covers all versions prior to the fixed releases across the 1.43, 1.44, 1.45, and 1.46 release trains.

RemediationAI

Upgrade the Timeline extension to one of the patched releases corresponding to your MediaWiki branch: 1.46.0, 1.45.4, 1.44.6, or 1.43.9. Consult the Wikimedia Phabricator task at https://phabricator.wikimedia.org/T426631 for patch details. If immediate upgrade is not possible, the most effective compensating control is to disable the Timeline extension entirely by removing or commenting out its inclusion in LocalSettings.php - this eliminates the attack surface with no side effect beyond loss of timeline rendering functionality. Alternatively, restrict page-editing permissions to trusted users only via MediaWiki's permission system ($wgGroupPermissions), reducing the authenticated attack surface; note this does not eliminate the vulnerability, only reduces who can trigger it. Do not rely on WAF filtering of timeline syntax as a primary control, as injection payloads may be obfuscated within valid-looking EasyTimeline directives.