What is the CVSS score of EUVD-2026-89480?

EUVD-2026-89480 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-89480?

Within 24 hours, inventory all MediaWiki instances and determine whether the EasyTimeline/Timeline extension is enabled and running a version before 1.46.1, 1.45.5, or 1.43.10; if any affected internet-facing or openly editable wiki cannot be patched immediately, temporarily disable the EasyTimeline extension or restrict page-edit and markup capabilities to trusted roles, and alert wiki administrators to review recent edits. Within 7 days, apply the vendor-released patches for the exact branch in use: 1.46.1, 1.45.5, or 1.43.10, test the extension after upgrading, and confirm that anonymous/open editing is either disabled or tightly controlled on sensitive wikis. Within 30 days, verify all MediaWiki and EasyTimeline instances are on patched versions, review wiki edit and authentication logs for suspicious or unexpected activity, and update vulnerability management and change-control processes to require prompt patching of the extension; note that no public exploit was identified at time of analysis, so prioritize based on data sensitivity and exposure.

MediaWiki EasyTimeline EUVD-2026-89480

| CVE-2026-103044 CRITICAL

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-09-29 wikimedia-foundation

GHSA-3cxg-pq55-vhm5

Code Injection Mediawiki Easytimeline Extension

9.8

CVSS 3.1 · Vendor: wikimedia-foundation

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access wiki page editor
Exploit

Submit crafted EasyTimeline markup
Execution

Trigger blind XPath injection in parser
Impact

Infer/extract backend XML data

Vulnerability Assessment

Weakness	CWE CWE-91 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization XPath query parameterization
Exploitation Conditions	Requires a MediaWiki installation with the EasyTimeline (Timeline) extension installed and enabled, and the ability to submit EasyTimeline markup - i.e., edit a page containing a <timeline> block that the extension parses. Exploitation is limited by the wiki's edit permissions: trivial on wikis permitting anonymous/open editing (consistent with PR:N) but gated behind account/role on wikis that restrict editing. The injection is blind, so data extraction is inference-based rather than direct, and affected versions are those before 1.46.1, 1.45.5, and 1.43.10.
Impact	Signals conflict on severity. The vendor/NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) describes a trivially exploitable, remote, unauthenticated flaw with total impact. However, the weakness class (CWE-91 XML/blind XPath injection) and the description point to data extraction/inference rather than code execution, so the I:H and A:H ratings appear aggressive - blind XPath injection most naturally yields confidentiality impact, not integrity/availability destruction. EPSS is low at 0.17% (6th percentile), the CVE is NOT on CISA KEV, and there is no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The PR:N rating also assumes an attacker can supply <timeline> markup, which is true on open/anonymous-edit wikis but requires an account on most production wikis - verify your wiki's edit policy. Net: a patch-worthy Critical-rated flaw that is realistically a medium-priority information-disclosure issue for most deployments given low EPSS, no known exploitation, and dependency on the EasyTimeline extension being installed and editable.
Exploit ScenarioDerived	An attacker who can edit a wiki page on a MediaWiki site with the EasyTimeline extension inserts a crafted <timeline> definition containing malicious XPath/XML syntax. When the extension parses the timeline input, the injected expression alters the backend XPath query, letting the attacker infer or extract XML-structured data through blind (inference-based) responses. No public proof-of-concept is currently available.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Blind XPath injection in the MediaWiki EasyTimeline (Timeline) extension lets an attacker who can submit <timeline> markup alter the extension's server-side XML/XPath query structure, potentially exposing data the wiki would not otherwise return. The flaw affects EasyTimeline before 1.46.1, 1.45.5, and 1.43.10; published scoring is severe (9.8, AV:N/AC:L/PR:N/UI:N) while independent assessment rates it as requiring edit privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because exploitation depends on being able to edit a page containing a <timeline> block - trivial on wikis that allow anonymous/open editing, but account- or role-gated where editing is restricted. Vendor-released patches exist (1.46.1 / 1.45.5 / 1.43.10), EPSS is low at 0.17% (6th percentile), and no public exploit identified at time of analysis.

RemediationAI

Upgrade the EasyTimeline extension to the fixed release for your MediaWiki branch: 1.46.1, 1.45.5, or 1.43.10 - vendor-released patches are available and the upstream fix is the Gerrit change at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/timeline/+/1346078 (tracked in https://phabricator.wikimedia.org/T428006). If you cannot patch immediately, disable the extension outright (remove it from the wiki's extension loading configuration or set the Timeline/EasyTimeline enable flag to false) - this fully removes exposure but stops all timeline rendering on the wiki. As an interim control with less functionality loss, restrict who can save pages containing <timeline> markup by tightening edit permissions (require a logged-in, confirmed account and/or restrict timeline use to a trusted group, or protect template pages that transclude timelines); this raises the effort required for the attack and matches the independent assessment's PR:L exploitation condition, but it does not fix the underlying injection and is bypassable by any user who retains editing rights. Also review recent edits containing <timeline> blocks for signs of injected expression syntax as a detection measure, recognizing there is no public exploit identified at time of analysis and therefore no specific payload signature to search for.

Affected VersionsENISA

Mediawiki - EasyTimeline extension 0 <1.46.1, 1.45.5, 1.43.10

Affected Packages

euvd mediawiki_easytimeline_extension_0_1_46_1_1_45_5 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is an XML injection (CWE-91, described as blind XPath injection) in the EasyTimeline extension, which renders user-authored <timeline> markup into graphical timelines. When a page containing a <timeline> block is rendered, the extension processes that markup server-side through an XML/XPath parsing path; because the supplied markup is not adequately neutralized before being incorporated into the query structure, an attacker can inject expression fragments that change what the underlying XPath query selects. The description labels the injection 'blind', meaning the extension does not directly echo extracted values back to the attacker, so any data exfiltration is inference-based (observing rendering differences, errors, or timing) rather than a straightforward read-out, which constrains practical impact despite high confidentiality scoring. Scoring signals conflict: the published vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) assumes no privileges and full integrity impact, whereas the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) recognizes that the attacker must be able to submit timeline markup through the wiki's edit interface and that blind extraction yields limited integrity impact. The affected component is identified via CPE cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_easytimeline_extension:*:*:*:*:*:*:*:* and EUVD-2026-89480; MediaWiki core without the extension enabled is not affected.

Know when Mediawiki Easytimeline Extension gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (wikimedia-foundation) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.1 HIGH

Remote via page edit, so AV:N/AC:L; supplying timeline markup usually needs an editing account (PR:L); blind XPath injection primarily discloses data, so C:H with minimal I and no A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 19:22 NVD

9.8 (CRITICAL)

Patch available

Sep 30, 2026 - 02:01 EUVD

CVE Published

Sep 29, 2026 - 22:46 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 22:46 cve.org

CRITICAL 9.8

DescriptionCVE.org

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.

This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

Executive ViewAI

Why It Matters

MediaWiki's EasyTimeline extension contains a critical blind XPath injection flaw that can expose data from affected wikis when a user can submit crafted <timeline> markup. The risk is greatest for open or anonymously editable wikis, where edit access is trivial, but the same exposure can occur on restricted wikis through compromised or overly privileged accounts. Leadership should care because internal or community knowledge bases often hold sensitive information, and unpatched instances of the affected branches remain vulnerable until the vendor fixes are applied.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Medium

popular MediaWiki extension, but not installed on every wiki

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.