MediaWiki EasyTimeline - Code Injection vulnerability recreation
06/08/2026Reverse and recreate CVE-2026-8857 and verify against deployed version of vulnersion version of application using deploy agent.
Additional context: https://phabricator.wikimedia.org/T426631
Stream metadata hidden
CVE-2026-8857 MediaWiki Timeline EasyTimeline.pl…
Completed
Clone the MediaWiki Timeline extension and locate the security patch for CVE-2026-8857 (fixed in 1.46.0 / 1.45.4 / 1.44.6 / 1.43.9)
Sandbox Agent
Completed
Locate and dump the CVE-2026-8857 security patch in the MediaWiki Timeline extension
Sandbox Agent
Completed
Deploy a vulnerable MediaWiki 1.43.x instance with the Timeline (EasyTimeline) extension for CVE-2026-8857 testing
Deploy Agent
Completed
Recreate and verify the CVE-2026-8857 RCE against the live vulnerable MediaWiki deployment
Sandbox Agent