CVE-2026-103044: EasyTimeline should not serve image maps as application/xml
Published Sep 29, 2026
·Updated
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
Other sources
XML injection (aka blind XPath injection) vulnerability in Wikimedia Foundation MediaWiki - EasyTimeline extension allows XML Injection.
This issue affects MediaWiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
— MITRE
Affected Software
1 affected component
Wikimedia Foundation MediaWiki EasyTimeline extension<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·10:46 PM
Data Sourced
via MITRE·10:46 PM
DescriptionWeakness
Data Sourced
via NVD·11:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which EasyTimeline versions are affected?
The vulnerability affects EasyTimeline versions before 1.46.1, 1.45.5, and 1.43.10.
2
What should teams do to remediate the issue?
Upgrade the EasyTimeline extension to 1.46.1, 1.45.5, 1.43.10, or a later applicable release.