Security notice
Running MediaWiki with the EasyTimeline (Timeline) extension? A remote code execution flaw is fixed in the June 29, 2026 security release. Update today.
MediaWiki sites that use the EasyTimeline (Timeline) extension need a security update. CVE-2026-8857 is remote code execution in the Perl script EasyTimeline runs to render timelines, via script injection in TextData, BarData and Scale. A related issue, CVE-2026-58038, is stored cross-site scripting in SVG files the extension generates. Wikimedia announced fixes in the June 29, 2026 security and maintenance releases: MediaWiki 1.43.9, 1.44.6 and 1.45.4, plus matching Timeline extension updates. Update today. If you cannot, disable the Timeline extension until you can. (Wikimedia security announcement)
What happened
- Remote code execution. CVE-2026-8857 (Wikimedia task T426631) hardens EasyTimeline against script injection via TextData and strips newlines from BarData and Scale text. Wikimedia describes a remote code execution vulnerability in the Perl script EasyTimeline executes to render timelines. (Wikimedia security announcement, CVE-2026-8857)
- Related SVG XSS. CVE-2026-58038 (T427611) covers stored cross-site scripting in SVG output from Timeline. Those SVGs are not used by MediaWiki by default in every setup, but they can still be hosted on your wiki. (Wikimedia security announcement, CVE-2026-58038)
- Fixes shipped June 29, 2026. Security and maintenance releases MediaWiki 1.43.9, 1.44.6 and 1.45.4, with Timeline/EasyTimeline updates in the extensions security supplement. Timeline is not bundled in every tarball but is widely used. (Wikimedia security announcement)
- What we could not confirm. Flare's brief said CISA added CVE-2026-8857 to KEV on November 5, 2026. When we checked CISA's KEV catalog JSON on November 6, 2026, that CVE ID was not listed. We do not claim CISA KEV status on this page.
Who should worry
Anyone who runs a MediaWiki site (a wiki is still a website) with the EasyTimeline / Timeline extension enabled.
- You host documentation, community or product wikis on MediaWiki with Timeline.
- Your agency or host manages MediaWiki for you and may have left Timeline enabled.
If you do not run MediaWiki, or you do not use the Timeline extension, this notice does not apply.
What to do now
- Update MediaWiki to 1.43.9, 1.44.6 or 1.45.4 (or a later supported release on your branch). (Wikimedia security announcement)
- Update the Timeline / EasyTimeline extension to the matching security release or current supported code for your branch. (Wikimedia security announcement)
- If you cannot update today, disable the Timeline extension until you can. Wikimedia notes you can re-enable it after the extension is updated. (Wikimedia security announcement)
- Prefer isolating Timeline rendering if you run it the way Wikimedia production does (Perl in a remote shellbox or similar). That limits exposure but is not a substitute for the update. (Wikimedia security announcement)
What to send your developer, agency or host
Please update every MediaWiki we run that has the EasyTimeline (Timeline) extension. CVE-2026-8857 is remote code execution via script injection in TextData/BarData/Scale; CVE-2026-58038 is related stored XSS in generated SVG. Fixed in the June 29, 2026 security releases: MediaWiki 1.43.9 / 1.44.6 / 1.45.4 and matching Timeline extension updates. Disable Timeline until patched if you cannot update today. Please confirm versions. Source: Wikimedia security announcement.
Common questions
Has my wiki been hacked?
This notice does not mean your wiki has been hacked. It means a serious Timeline flaw was fixed in June 2026 and you should make sure you are on those releases (or have Timeline off).
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see whether your site runs MediaWiki, which extensions are enabled, or which versions they are on. A scan without a warning about this does not mean your wiki is safe.
Is updating MediaWiki core enough?
No. You also need the Timeline / EasyTimeline extension update (or keep the extension disabled). (Wikimedia security announcement)
Where can I follow updates?
Follow the Wikimedia security announcement and the CVE records for CVE-2026-8857 and CVE-2026-58038. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Wikimedia security announcement: "Security and maintenance release: 1.43.9 / 1.44.6 / 1.45.4", Sam Reed, June 29, 2026; EasyTimeline RCE T426631 / CVE-2026-8857; SVG XSS T427611 / CVE-2026-58038; checked November 6, 2026.
- CVE Program: CVE-2026-8857 and CVE-2026-58038 (Wikimedia Foundation), checked November 6, 2026.
- CISA KEV catalog JSON, checked November 6, 2026: CVE-2026-8857 not present in that snapshot.