CVE-2026-58038 Wikimedia Foundation CVE debrief

Who should care

Users of MediaWiki timeline, particularly those with versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9, should be aware of this XSS vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and adjust input validation and sanitization for timeline data.

Technical summary

The vulnerability exists in the MediaWiki timeline, specifically in program files includes/Timeline.Php and scripts/EasyTimeline.Pl. It allows for cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. The affected versions are before 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Affected product deployments should be confirmed in managed environments, and an owner should be assigned for follow-up.

Defensive priority

Medium priority should be given to updating MediaWiki timeline to a secure version, as XSS vulnerabilities can lead to significant security risks.

Recommended defensive actions

• Update MediaWiki timeline to version 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later.
• Review and adjust input validation and sanitization for timeline data.
• Monitor for suspicious activity related to timeline usage.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. However, further analysis is required to fully understand the impact and to verify the affected versions. Affected product deployments should be confirmed in managed environments, and an owner should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. The vulnerability exists in the MediaWiki timeline, specifically in program files includes/Timeline.Php and scripts/EasyTimeline.Pl. It allows for cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation.

Official resources