High · 7.5 CVE-2026-100242 EUVD-2026-89081GHSA-pc77-95w9-j7gj

DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Published Sep 29, 2026 · Updated Oct 1, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: Mediawiki - DataTransfer Extension Category: Web / CMS

Description

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.

This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

Affected products

Vendor	Product	Affected	Fixed
Wikimedia Foundation	Mediawiki - DataTransfer Extension	1.46.0 – < 1.47.0	1.47.0

References

https://phabricator.wikimedia.org/T433275
https://gerrit.wikimedia.org/r/q/Ibc4a9070c2425b690bc767a882e4c35046a39be7
https://github.com/advisories/GHSA-xh5m-36r6-47m3