Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline.

This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl.



This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published: 2026-07-01
Score: 0 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stored cross‑site scripting issue exists in the EasyTimeline component of the Wikimedia Foundation Timeline application. Input supplied in JavaScript URLs within SVG files is not properly neutralized, allowing malicious code to be stored and later executed when a user views a timeline containing the affected SVG. This corresponds to CWE‑79 and can lead to script execution in the context of the user’s session.

Affected Systems

The Wikimedia Foundation Timeline application, including all releases before version 1.46.0 and the snapshots 1.45.4, 1.44.6, and 1.43.9, is affected. These versions use the EasyTimeline module, which processes SVG files without sanitizing JavaScript URLs.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity, while the EPSS score of less than 1% suggests a low probability of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to insert or modify JavaScript URLs in SVG files that are processed by EasyTimeline; once injected, the stored XSS payload would execute when a user later renders the timeline.

Generated by OpenCVE AI on July 21, 2026 at 14:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Wikimedia Foundation Timeline application to version 1.46.0 or later, where JavaScript URLs in SVG files are properly sanitized.
  • If an immediate upgrade is not possible, enforce strict input validation so that only safe URL schemes are accepted by EasyTimeline.
  • Deploy a Content Security Policy that blocks inline script execution within SVG elements to add an additional defense against stored XSS.

Generated by OpenCVE AI on July 21, 2026 at 14:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia timeline
Vendors & Products Wikimedia
Wikimedia timeline

Fri, 03 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N'}

threat_severity

Low

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Title Stored XSS through javascript URLs in SVGs generated by EasyTimeline
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 0, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wikimedia Timeline
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T15:47:50.725Z

Reserved: 2026-06-27T13:32:41.613Z

Link: CVE-2026-58038

cve-icon Vulnrichment

Updated: 2026-07-01T15:47:47.332Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-01T15:04:01Z

Links: CVE-2026-58038 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')