CVE-2026-8857 · MediaWiki EasyTimeline code injection via crafted timeline markup

01 · The Real Story

A chart-drawing tool hands any editor a remote shell

CVE-2026-8857 is a CWE-94 code injection flaw in the MediaWiki timeline rendering path, specifically the EasyTimeline Perl backend (scripts/EasyTimeline.pl) and the PHP wrapper (includes/Timeline.php). An editor who can submit timeline markup can inject code that the rendering process executes, potentially running arbitrary commands as the web server user. Affected versions are 1.43.0–1.43.8, 1.44.0–1.44.5, 1.45.0–1.45.3, and pre-1.46.0 timelines; fixed in 1.43.9, 1.44.6, 1.45.4, and 1.46.0.

Vendor severity HIGH/8.8 is defensible: the attack is network-reachable, low-privilege, no user interaction, and gives full confidentiality/integrity/availability on the wiki host. The practical severity stays high rather than critical because the attacker must hold a valid editor account, EasyTimeline must be enabled, and MediaWiki deployments are not canonical identity/backup/edge infrastructure. In organizations where internal wikis gate sensitive data, treat this as a high-priority patch.

"Any authenticated wiki editor can turn a timeline chart into a shell — patch MediaWiki's timeline code now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain a wiki editor account

The attacker needs an account with edit access on the target MediaWiki instance. This can be done by self-registering if open, using stolen credentials, or compromising a low-privilege account through phishing or credential stuffing. Account creation may be gated by CAPTCHA or email verification.

Conditions required:

MediaWiki instance is reachable over HTTP(S)
Account registration is open OR attacker has valid credentials
User has edit and timeline/edittimeline permissions if separate

Where this breaks in practice:

Open registration may be disabled on internal deployments
MFA/SSO can block credential-stuffing
Account creation CAPTCHAs slow automated signups

Detection/coverage: Check auth logs for unusual account creation or login, CAPTCHA failures, and edits from new accounts.

STEP 02

Enable or confirm EasyTimeline rendering

The target wiki must have the timeline extension or core timeline feature active. In default MediaWiki, EasyTimeline is often installed but may be disabled; administrators may enable it for charts. If disabled, the malicious timeline tag is not processed.

Conditions required:

EasyTimeline extension is installed and enabled
The $wgEnableTimeline or equivalent setting is true
The attacker can include <timeline> markup in pages

Where this breaks in practice:

Many hardened deployments disable unused extensions
Timeline rendering may be limited to specific namespaces or groups

Detection/coverage: Configuration review or scan for wfLoadExtension('EasyTimeline') / $wgEnableTimeline settings.

STEP 03

Post crafted timeline markup

The attacker edits a page and inserts a <timeline> block containing malicious code or directives. The PHP wrapper Timeline.php passes this untrusted input to EasyTimeline.pl, which builds a command/script or evaluates code without proper sanitization, triggering CWE-94.

Conditions required:

Attacker can edit a page that will be rendered
Timeline parser is reachable via the web request path
Input reaches the vulnerable sink in EasyTimeline.pl/Timeline.php

Where this breaks in practice:

Some wikis restrict raw HTML/timeline to administrators
Input filtering or a WAF may strip suspicious timeline syntax
Preview/edit permissions may be separated from render permissions

Detection/coverage: WAF rules on timeline tags, file integrity monitoring on scripts/EasyTimeline.pl, server-side logs of unusual Perl child processes.

STEP 04

Achieve command execution as web server user

The injected code runs with the privileges of the web server/PHP process, often www-data or apache. The attacker can execute system commands, read LocalSettings.php to obtain database credentials, modify wiki content, upload webshells, or pivot to the database and internal hosts.

Conditions required:

Web server/PHP process has permission to execute external commands
PHP disable_functions does not block the relevant functions
No SELinux/AppArmor deny rules prevent execution

Where this breaks in practice:

PHP disable_functions may block exec, system, shell_exec, proc_open
Least-privilege web server accounts limit immediate damage
Containerized MediaWiki may constrain the blast radius

Detection/coverage: EDR/HIDS on web server should alert on unexpected child processes from EasyTimeline.pl; DB query monitoring may show abnormal reads of LocalSettings.php.

STEP 05

Pivot to database and internal resources

With LocalSettings.php credentials, the attacker connects to the wiki database and exfiltrates user tables, password hashes, and private content. If the web server has network access to internal systems, the attacker can move laterally to other application servers or use captured credentials for further access.

Conditions required:

Database server is reachable from the web host
Database account has read/write access to wiki tables
Network segmentation does not isolate the web tier from internal resources

Where this breaks in practice:

SQL server may be on a separate network segment
Database user permissions may be limited to the wiki schema
Internal egress filtering may block outbound exfiltration

Detection/coverage: Network flow logs showing unexpected database connections from the web server; SIEM correlation of web edits with DB anomalies.

03 · Compensating Control

HIGH 8.8→IGNORE 0.0

SEVERITY REDUCED

Upgrade MediaWiki to the fixed branch — Apply vendor fix to remove the code injection sink. For HIGH severity, noisgate remediation SLA is ≤180 days; deploy 1.43.9 / 1.44.6 / 1.45.4 / 1.46.0 in test immediately and production as soon as possible.

HIGH 8.8→IGNORE 0.0

SEVERITY REDUCED

Disable EasyTimeline rendering — Set $wgEnableTimeline = false; or unload the EasyTimeline extension until patch. This breaks the attack chain at step 2; deploy within 30 days as the noisgate mitigation SLA for HIGH.

HIGH 8.8→MEDIUM 5.9

SEVERITY REDUCED

Restrict edit and account creation to trusted users — Close self-registration and limit edit plus timeline permissions to authenticated staff; enforce SSO/MFA. This raises the precondition from low-privilege to trusted/compromised account, reducing exposure; residual severity is MEDIUM because a stolen trusted account can still exploit.

HIGH 8.8→MEDIUM 5.0

SEVERITY REDUCED

Harden the web server process and add WAF timeline rules — Disable dangerous PHP execution functions (exec, system, shell_exec, proc_open), enforce SELinux/AppArmor confinement, and add WAF rules for suspicious <timeline> markup. This degrades step 4 and reduces impact; residual severity is MEDIUM if all controls are enforced.

What doesn't work

Restricting timeline to certain namespaces may not help if attackers can create pages in those namespaces.
HTTPS-only and generic WAF rules without timeline-specific inspection won't stop code injection embedded in a legitimate <timeline> tag.
Backups alone do not mitigate this; they help recovery after defacement but not command execution or data exfiltration.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No KEV listing and no known active exploitation as of this assessment; EPSS 0.02098 indicates low single-digit 30-day exploitation probability.
Proof-of-concept availability	No public PoC observed in GitHub, PocIndex, or Nuclei template searches tied to this CVE; limited technical detail beyond the CVE record and Wikimedia Phabricator T426631.
EPSS score / percentile	EPSS 0.02098 (2.1%); percentile not provided by live search sources, but score is below typical patch-now thresholds.
KEV status	Not listed in CISA Known Exploited Vulnerabilities.
CVSS vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High; network attack, low privileges, no user interaction, full CIA impact.
Affected versions	MediaWiki 1.43.0 through <1.43.9, 1.44.0 through <1.44.6, 1.45.0 through <1.45.4, and pre-1.46.0 branch.
Fixed versions	1.43.9, 1.44.6, 1.45.4, 1.46.0. Check distro backports for older package versions.
Scanning / exposure data	No GreyNoise/Shodan/Censys/FOFA scanner data surfaced in live search results; MediaWiki internet exposure is broad, but this flaw requires an authenticated edit path.
Disclosure date	2026-07-01 (NVD/MITRE publication; reserved 2026-05-18).
Reporting researcher / org	Not credited in public snippets; tracked via Wikimedia Phabricator T426631 and mirrored by CIRCL/INCIBE.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (8.8/10)

Why this verdict

Low-privilege network attack: CVSS 3.1 already assumes PR:L; real-world account creation on public MediaWiki is common, so the 8.8 baseline holds.
Role multiplier: low-value dev wikis are trivial; typical internal/public wiki app tier gives RCE and data theft (HIGH); MediaWiki is not canonically identity/CA/backup/edge/CI-CD, so no domain/fleet/supply-chain floor, and no CRITICAL floor applies.
No active exploitation/KEV: EPSS 0.02098 and no KEV listing mean no immediate patch-now override; severity stays HIGH.

Why not higher?

Not CRITICAL because the bug requires a valid editor account (PR:L), the timeline feature is often disabled in hardened deployments, and MediaWiki rarely occupies identity/CA/backup/network-edge/CI-CD high-value roles. The impact on a typical wiki host is serious but not fleet- or domain-wide.

Why not lower?

Not MEDIUM because the exploit path is direct code injection to command execution with only low privileges, no user interaction, and successful exploitation gives full control over the web server and likely database credentials. Many public MediaWiki instances allow self-registration, so the principal friction is modest.

06 · Verification

Crowdsourced verification payload.

Run this on the MediaWiki application server with read access to the MediaWiki installation directory. Invoke: bash check_cve_2026_8857.sh /var/www/mediawiki (adjust the path). The script queries the installed MediaWiki version and checks whether EasyTimeline is enabled; it exits 0 for VULNERABLE, 1 for PATCHED, and 3 for UNKNOWN.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
set -uo pipefail
MW_DIR="${1:-.}"
if [ ! -d "$MW_DIR" ]; then echo "UNKNOWN: directory not found: $MW_DIR" >&2; exit 3; fi

# Check LocalSettings for EasyTimeline enablement
timeline_enabled="maybe"
if [ -f "$MW_DIR/LocalSettings.php" ]; then
  if grep -Eq "wfLoadExtension\( *['\"]EasyTimeline['\"] *\)|require_once.*EasyTimeline" "$MW_DIR/LocalSettings.php"; then
    timeline_enabled="yes"
  elif grep -Eq "\$wgEnableTimeline *= *false" "$MW_DIR/LocalSettings.php"; then
    echo "PATCHED: EasyTimeline explicitly disabled in LocalSettings.php"
    exit 1
  fi
fi

# Determine MediaWiki version
version=""
if command -v php >/dev/null 2>&1 && [ -f "$MW_DIR/maintenance/version.php" ]; then
  version="$(php "$MW_DIR/maintenance/version.php" 2>/dev/null | tr -d '\r' | head -n1)"
fi
if [ -z "$version" ] && [ -f "$MW_DIR/includes/DefaultSettings.php" ]; then
  version="$(grep -m1 -E '\$wgVersion *=' "$MW_DIR/includes/DefaultSettings.php" 2>/dev/null | sed -E 's/.*=\s*['\"']?([^'\"';]+)['\"']?;.*/\1/' | tr -d '[:space:]')"
fi
if [ -z "$version" ]; then echo "UNKNOWN: could not determine MediaWiki version" >&2; exit 3; fi

# Compare against fixed branch versions
for fixed in 1.43.9 1.44.6 1.45.4 1.46.0; do
  if [ "$(printf '%s\n%s\n' "$version" "$fixed" | sort -V | head -n1)" = "$version" ] && [ "$version" != "$fixed" ]; then
    echo "VULNERABLE: MediaWiki $version < $fixed and EasyTimeline is present/enabled"
    exit 0
  fi
  if [ "$version" = "$fixed" ]; then
    echo "PATCHED: MediaWiki $version is at fixed branch version $fixed"
    exit 1
  fi
done

echo "PATCHED: MediaWiki $version is >= fixed versions"
exit 1