CVE-2026-8857: MediaWiki Timeline Code Injection Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-8857 is a code injection vulnerability (CWE-94) in MediaWiki's timeline rendering subsystem. The vulnerability stems from insufficient input validation in the EasyTimeline.Pl script and Timeline.Php include file, allowing authenticated users to inject and execute arbitrary code during timeline processing. The CVSS 3.1 score of 8.8 (HIGH) reflects a network-exploitable attack requiring valid credentials (PR:L), with no user interaction needed, and potential for complete system compromise (C:H, I:H, A:H). The attack surface is limited to authenticated users but unrestricted within that scope.

Business impact

Successful exploitation enables internal threat actors or compromised wiki accounts to achieve remote code execution, risking data exfiltration, wiki content manipulation, server resource hijacking, and lateral movement to backend systems. For public wikis with open registration, the barrier to exploitation is simply creating a free account. Organizational wikis face risk from disgruntled insiders or compromised editor accounts. Downtime, reputation damage, and forensic costs accompany remediation.

Affected systems

MediaWiki versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are vulnerable. Organizations running any version of MediaWiki outside these patched releases should assume exposure. The timeline functionality is not always enabled by default but is commonly used in documentation and knowledge-base deployments. Check your MediaWiki version immediately and review which skins and extensions are in use.

Exploitability

This vulnerability requires valid user authentication, reducing opportunistic attack likelihood but increasing insider risk. No exploit code has been publicly confirmed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the injection mechanism is relatively straightforward once credentials are obtained, and script-kiddie tools will emerge quickly after patch release. Threat actors targeting specific organizations with wiki-based workflows represent the highest near-term risk. The low barrier to account creation on public wikis presents a significant exploitation vector.

Remediation

Patch immediately to MediaWiki 1.46.0, 1.45.4, 1.44.6, or 1.43.9 or later, depending on your current release line. Before patching, audit user account creation logs and timeline edits from recent weeks to identify suspicious activity. Restrict timeline functionality to trusted users via permission controls as an interim measure. Review wiki access logs and timeline processing logs for signs of exploitation. Consider temporarily disabling timeline features if patching cannot be done within 48 hours.

Patch guidance

MediaWiki provides updates for four concurrent release branches. Identify your current version (visible in Special:Version). If on 1.46.x, upgrade to 1.46.0 or later. If on 1.45.x, apply 1.45.4 or later. If on 1.44.x, apply 1.44.6 or later. If on 1.43.x, apply 1.43.9 or later. Versions 1.42 and earlier are end-of-life and receive no security patches—migration to a supported branch is mandatory. Test patches in a staging environment that mirrors production database size and user load before deployment. Plan for brief wiki unavailability during the upgrade window.

Detection guidance

Monitor web server and PHP error logs for unusual code execution errors or parse failures in Timeline.Php. Enable MediaWiki logging for user actions on pages containing timeline tags. Search recent edit histories for timeline syntax injection attempts (look for unusual characters, command separators, or script tags within timeline markup). Review web access logs for POST requests to timeline-related endpoints from unusual geographic locations or user agents. Implement rate-limiting on timeline processing to catch bulk injection attempts. Check for suspicious database queries logged during timeline rendering.

Why prioritize this

This vulnerability merits immediate patching due to its HIGH CVSS score and remote code execution capability. While requiring authentication, the low friction for account creation on many wikis and the high-impact consequences of code execution justify top-tier remediation priority. Organizations with open-enrollment wikis or sensitive content should patch within 24–48 hours. Internal wikis with restricted user bases may accept slightly longer timelines if comprehensive logging controls are in place.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects three factors: (1) network accessibility without special network conditions (AV:N), (2) low attack complexity—exploitation does not require system-specific tricks (AC:L), (3) requirement for valid login credentials (PR:L), (4) no user interaction needed (UI:N), (5) confidentiality, integrity, and availability all fully compromised (C:H, I:H, A:H). The post-authentication requirement prevents mass automated exploitation but does not significantly reduce risk in environments where account registration is unrestricted.

Frequently asked questions