CVE-2026-100242

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Resource Consumption in MediaWiki DataTransfer Extension

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: wikimedia-foundation

Description

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100242

EUVD

EUVD-2026-89081

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki_datatransfer_extension	From 1.46.0 (inc) to 1.47.0 (exc)
phpspreadsheet	phpspreadsheet	From 1.30.5 (inc) to 5.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves two issues in the Wikimedia Foundation MediaWiki DataTransfer Extension. First, it depends on a third-party component that has its own vulnerabilities. Second, it allows uncontrolled resource consumption, specifically excessive memory allocation. This occurs when processing certain files, leading to potential system slowdowns or crashes.

Detection Guidance

To detect this vulnerability, check the installed version of PhpSpreadsheet in your MediaWiki DataTransfer Extension environment. Compare it against patched versions (1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1). Use commands like 'composer show phpoffice/phpspreadsheet' or 'grep -r "phpspreadsheet" /path/to/extension' to verify versions.

Impact Analysis

If you use the affected MediaWiki DataTransfer Extension versions (1.46.0 to before 1.47.0), an attacker could exploit this to cause denial of service by consuming excessive system resources. This might result in your wiki becoming unresponsive or crashing during file processing operations.

Compliance Impact

This vulnerability primarily causes uncontrolled resource consumption leading to denial of service, which may indirectly impact compliance by disrupting data availability or processing capabilities. However, the provided context does not explicitly link this issue to specific compliance requirements such as GDPR or HIPAA.

Mitigation Strategies

Update Mediawiki - DataTransfer Extension to version 1.47.0 or later to address the vulnerability. Ensure all third-party components are patched and monitor for unusual memory consumption during file processing.

Hi! I’m here to help you understand CVE-2026-100242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70