CVE-2026-103044 in MediaWiki
Summary
by MITRE • 09/30/2026
XML injection (aka blind XPath injection) vulnerability in Wikimedia Foundation MediaWiki - EasyTimeline extension allows XML Injection.
This issue affects MediaWiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The identified security flaw resides within the Wikimedia Foundation's MediaWiki platform, specifically affecting the EasyTimeline extension prior to versions 1.46.1, 1.45.5, and 1.43.10. This vulnerability is classified as an XML injection issue, which in this context manifests technically as a blind XPath injection. The root cause stems from insufficient sanitization of user-supplied input when it is processed by the extension's rendering engine for timeline generation. When maliciously crafted data containing XPath expressions or structured XML payloads is injected into parameters that are subsequently evaluated without proper validation, the application fails to distinguish between legitimate configuration data and executable query logic. This lack of strict type checking and output encoding allows an attacker to manipulate the underlying database queries or internal parsing routines, effectively bypassing intended access controls and logical boundaries within the extension's functionality.
From a technical perspective, this vulnerability aligns with CWE-91, which describes XML Injection vulnerabilities where untrusted data is used to construct XML documents or XPath expressions. The specific mechanism here leverages the blind nature of the injection, meaning that while direct output might not be visible in the application response due to security controls like error suppression, the attacker can still infer information through side-channel effects such as timing differences or boolean-based logical deductions. This technique is categorized under MITRE ATT&CK tactic T1059, specifically Command and Scripting Interpreter sub-techniques related to XML processing, although in this instance it serves primarily for data exfiltration or logic manipulation rather than direct command execution on the host system. The attacker can potentially extract sensitive information stored within the MediaWiki database by crafting payloads that trigger different responses based on the truth value of injected XPath conditions.
The operational impact of this vulnerability is significant, particularly in environments where user-generated content is processed through timeline features without rigorous administrative oversight. An authenticated attacker with permission to create or edit pages utilizing the EasyTimeline extension can exploit this flaw to read arbitrary data from the backend database. This could lead to the exposure of sensitive information such as user credentials hashes, session tokens, internal configuration details, or other private wiki content that is not intended for public consumption. Furthermore, depending on the specific database engine and its capabilities, there may be potential implications for integrity manipulation if the injection vector allows for write operations, although the primary risk in blind XPath scenarios remains data disclosure. The vulnerability undermines the confidentiality guarantees of the platform and can serve as a stepping stone for further attacks against the broader MediaWiki infrastructure.
Mitigation strategies must focus on immediate patching and defensive coding practices. Administrators running affected versions should upgrade to EasyTimeline version 1.46.1, 1.45.5, or 1.43.10 immediately, as these releases contain fixes for the input validation logic that prevents malicious XPath expressions from being evaluated. In cases where immediate patching is not feasible due to compatibility constraints, temporary mitigations include restricting access to pages using the EasyTimeline extension to trusted users only and implementing Web Application Firewall rules that detect common XPath injection patterns in POST or GET parameters associated with timeline generation. Long-term remediation requires enforcing strict input validation by whitelisting expected characters for timeline data and ensuring that all dynamic content is properly escaped before being passed to XML parsing functions, thereby neutralizing the ability of attackers to inject executable query logic into the application's processing pipeline.