Summary:
T426631: CVE-2026-8857: Full RCE using EasyTimeline Extension introduced hardening in the EasyTimeline extension to detect and remove vertical whitespace characters from text attributes of BarData or TextData. However, the current implementation removes the byte 0x85 indiscriminately, even when it appears as part of a valid UTF-8 multibyte sequence. The hardening appears to use Perl Regular Expression Character Class \v for detection and removal. In Perl, \v matches the NEXT LINE character (U+0085). If the sanitization is performed on raw bytes rather than decoded Unicode characters, it can incorrectly remove the 0x85 byte from valid UTF-8 multibyte sequences.
Steps to replicate the issue (include links if applicable):
- Create a timeline with method="svg2png" (just for verbose error output).
- Add a BarData or TextData whose text attribute contains a character such as "々" (U+3005: E3 80 85) or "居" (U+5C45: E5 B1 85), whose UTF-8 encoding includes the byte 0x85.
- Save the page or preview it.
What happens?:
<timeline method="svg2png"> ImageSize = width:500 height:500 PlotArea = left:50 right:50 bottom:50 top:50 AlignBars = justify DateFormat = yyyy Period = from:2000 till:2010 TimeAxis = orientation:vertical ScaleMajor = unit:year increment:5 start:2000 TextData = pos:(10,10) text:"々" BarData = bar:Leaders text:"々" PlotData = bar:Leaders from:start till:end text:"々" </timeline>
Unable to convert SVG to PNG:
EasyTimeline version 1.90
Copyright (C) 2004 Erik Zachte
Email xxx@chello.nl (nospam: xxx=epzachte)
This program is free software; you can redistribute it
and/or modify it under the terms of the
GNU General Public License version 2 as published by
the Free Software Foundation
------------------------------------------------------
OS Linux detected -> create image in png format.
Input: Script file file
Output: Image files file.png & file.svg
Map file file.map (add to html for clickable map)
Ploticus input file = /tmp/EasyTimeline.txt.354902
Generating output:
Using ploticus command "/usr/bin/ploticus" (/usr/bin/ploticus)
Running Ploticus to generate svg file file.svg
'/usr/bin/ploticus' -noshell -svg -o 'file.svg' '/tmp/EasyTimeline.txt.354902' -tightcrop -font ''FreeSans'' -xml_encoding UTF-8
Running Ploticus to generate bitmap file file.png
'/usr/bin/ploticus' -noshell -png -o 'file.png' '/tmp/EasyTimeline.txt.354902' -tightcrop -font 'FreeSans'
WARNING(S)
Line 9: pos:(10,10) text:"々"
- TextData attribute 'text' contains ~ (tilde).
Tilde will not be translated into newline character (only in PlotData)
Line 11: bar:Leaders text:"々"
- BarData attribute 'text' contains ~ (tilde).
Tilde will not be translated into newline character (only in PlotData)
READY
No errors found.
PHP Warning: Failed to set memory limit to 0 bytes (Current memory usage is 2097152 bytes) in Unknown on line 0
Error reading SVG file.svg: XML parse error: Error domain 1 code 9 on line 29 column 41 of data: Input is not proper UTF-8, indicate encoding !
Bytes: 0xE3 0x80 0x7E 0x3CWhat should have happened instead?:
The text attributes should remain unchanged, and the UTF-8 characters should be rendered correctly.
Other information:
This issue was originally reported on ja:Wikipedia:バグの報告#timeline_における_Unable_to_convert_SVG_to_PNG_(XML_parse_error)エラー.