The EasyTimeline extension of Mediawiki contains an XML injection flaw, also described as blind XPath injection, that allows an attacker to insert arbitrary XML payloads. By delivering crafted XML through the exposed image map interface, the vulnerable system can execute malicious code or manipulate internal data. The weakness is an instance of CWE‑91 and could compromise confidentiality, integrity, and availability of the affected Wiki instance.

Affecté Wikimedia Foundation installations running the Mediawiki EasyTimeline extension prior to version 1.46.1, 1.45.5, or 1.43.10. Any mediawiki site that has not yet upgraded to one of those release points or later is potentially vulnerable. The vendor explicitly lists those versions as affected in the advisory.

EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.8, indicating a critical severity. Because the flaw is an XML injection that permits arbitrary code execution, the vulnerability can be exploited with only an XML payload sent to the image‑map endpoint. The absence of a public exploit does not eliminate risk; an attacker with the ability to manipulate image map requests can exploit the vulnerability to compromise the host.