PT-2026-102932

CVE-2026-103044

Published

2026-09-29

Updated

2026-10-01

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mediawiki - EasyTimeline extension versions prior to 1.46.1 Mediawiki - EasyTimeline extension version 1.45.5 Mediawiki - EasyTimeline extension version 1.43.10

Description An XML injection issue, also known as blind XPath injection, exists in the Mediawiki - EasyTimeline extension. This allows an attacker to inject XML, which can be used to manipulate XPath queries to extract information from the XML document structure without the application returning the results directly in the response.

Recommendations Update Mediawiki - EasyTimeline extension to a version newer than 1.46.1. Update Mediawiki - EasyTimeline extension to a version newer than 1.45.5. Update Mediawiki - EasyTimeline extension to a version newer than 1.43.10.

Exploitability

Fix

Impacts

Researchers

Scott Bassett

Somerandomdeveloper

Vendors

Affected products

Weakness enumeration

CWE-91: XML Injection (aka Blind XPath Injection)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers