CVE-2026-103044

Name of the Vulnerable Software and Affected Versions Mediawiki - EasyTimeline extension versions prior to 1.46.1 Mediawiki - EasyTimeline extension version 1.45.5 Mediawiki - EasyTimeline extension version 1.43.10

Description An XML injection issue, also known as blind XPath injection, exists in the Mediawiki - EasyTimeline extension. This allows an attacker to inject XML, which can be used to manipulate XPath queries to extract information from the XML document structure without the application returning the results directly in the response.

Recommendations Update Mediawiki - EasyTimeline extension to a version newer than 1.46.1. Update Mediawiki - EasyTimeline extension to a version newer than 1.45.5. Update Mediawiki - EasyTimeline extension to a version newer than 1.43.10.