CVE-2026-100242 — DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

CVE-2026-100242

DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) PUBLISHED

Description (CNA)

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / Mediawiki - DataTransfer Extension	affected 1.46.0 before 1.47.0

CWE

CWE-1395, CWE-400

References

https://phabricator.wikimedia.org/T433275
https://gerrit.wikimedia.org/r/q/Ibc4a9070c2425b690bc767a882e4c35046a39be7
https://github.com/advisories/GHSA-xh5m-36r6-47m3

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/advisories/GHSA-xh5m-36r6-47m3