{"schema":"threatline.record/2","record":{"id":"CVE-2026-100242","aliases":["CVE-2026-59933","GHSA-xh5m-36r6-47m3"],"summary":"DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)","details":"Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.\n\nThis issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.","categories":["Applications & CMS"],"product":"Mediawiki - DataTransfer Extension","vendor":"Wikimedia Foundation","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100242","source_modified_at":"2026-10-01T18:13:42.072Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Mediawiki - DataTransfer Extension","vendor":"Wikimedia Foundation","versions":[{"status":"affected","version":"1.46.0","lessThan":"1.47.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.8.1"}]}],"versions":["4.0.0","4.1.0","4.2.0","4.3.0","4.3.1","4.4.0","4.5.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.5.0","5.6.0","5.7.0","5.8.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.10.7"}]}],"versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0","3.9.1","3.9.2","3.9.3"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.4.7"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.3.0","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.18"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6"}]}],"versions":["1.0.0","1.0.0-beta","1.0.0-beta2","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.17.1","1.18.0","1.19.0","1.2.0","1.2.1","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.24.1","1.25.0","1.25.1","1.25.2","1.26.0","1.27.0","1.27.1","1.28.0","1.29.0","1.29.1","1.29.10","1.29.11","1.29.12","1.29.2","1.29.4","1.29.5","1.29.6","1.29.7","1.29.8","1.29.9","1.3.0","1.3.1","1.30.0","1.30.1","1.30.2","1.30.3"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100242","source_modified_at":"2026-10-01T18:13:42.072Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Mediawiki - DataTransfer Extension","ecosystem":null},"version":"1.47.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"version":"5.8.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"version":"3.10.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"version":"2.4.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"version":"2.1.18"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","source_modified_at":"2026-07-23T16:27:55.018643Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"version":"1.30.6"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00339,"percentile":0.26116,"score_date":"2026-10-23"},"published_at":"2026-09-29T16:40:18.122Z","modified_at":"2026-10-01T18:13:42.072Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100242","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T18:13:42.072Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-07-23T16:27:55.018643Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100242","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://phabricator.wikimedia.org/T433275"},{"source":"CVE List","url":"https://gerrit.wikimedia.org/r/q/Ibc4a9070c2425b690bc767a882e4c35046a39be7"},{"source":"CVE List","url":"https://github.com/advisories/GHSA-xh5m-36r6-47m3","tags":["exploit"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-01T18:11:41.266497Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T18:13:42.072Z","content_hash":"25fa360f98af61e6c0120368cb6a867d029f6dca5f6d374e44fc47727f8c07b4"}}