All vulnerabilities
CVE-2026-100242CVE-2026-59933GHSA-xh5m-36r6-47m3

DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Wikimedia Foundation Mediawiki - DataTransfer ExtensionPackagistApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.47.0Also 5.8.1, 3.10.7 and 3 moreCVE List
Published29 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 1.47.0Mediawiki - DataTransfer ExtensionCVE List
  • 5.8.1phpoffice/phpspreadsheet, PackagistOSVcomposer require "phpoffice/phpspreadsheet:^5.8.1"
  • 3.10.7phpoffice/phpspreadsheet, PackagistOSVcomposer require "phpoffice/phpspreadsheet:^3.10.7"
  • 2.4.7phpoffice/phpspreadsheet, PackagistOSVcomposer require "phpoffice/phpspreadsheet:^2.4.7"
  • 2.1.18phpoffice/phpspreadsheet, PackagistOSVcomposer require "phpoffice/phpspreadsheet:^2.1.18"
  • 1.30.6phpoffice/phpspreadsheet, PackagistOSVcomposer require "phpoffice/phpspreadsheet:^1.30.6"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.

This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

Text from CVE List

Affected versions 127

  • Mediawiki - DataTransfer Extensionaffected: 1.46.0 before 1.47.0CVE List
  • phpoffice/phpspreadsheet, Packagistfrom 4.0.0, fixed in 5.8.1OSV
  • phpoffice/phpspreadsheet, Packagist4.0.0OSV
  • phpoffice/phpspreadsheet, Packagist4.1.0OSV
  • phpoffice/phpspreadsheet, Packagist4.2.0OSV
  • phpoffice/phpspreadsheet, Packagist4.3.0OSV
  • phpoffice/phpspreadsheet, Packagist4.3.1OSV
  • phpoffice/phpspreadsheet, Packagist4.4.0OSV
  • phpoffice/phpspreadsheet, Packagist4.5.0OSV
  • phpoffice/phpspreadsheet, Packagist5.0.0OSV
  • phpoffice/phpspreadsheet, Packagist5.1.0OSV
  • phpoffice/phpspreadsheet, Packagist5.2.0OSV
  • phpoffice/phpspreadsheet, Packagist5.3.0OSV
  • phpoffice/phpspreadsheet, Packagist5.4.0OSV
  • phpoffice/phpspreadsheet, Packagist5.5.0OSV
  • phpoffice/phpspreadsheet, Packagist5.6.0OSV
  • phpoffice/phpspreadsheet, Packagist5.7.0OSV
  • phpoffice/phpspreadsheet, Packagist5.8.0OSV
  • phpoffice/phpspreadsheet, Packagistfrom 3.3.0, fixed in 3.10.7OSV
  • phpoffice/phpspreadsheet, Packagist3.10.0OSV
  • phpoffice/phpspreadsheet, Packagist3.10.1OSV
  • phpoffice/phpspreadsheet, Packagist3.10.2OSV
  • phpoffice/phpspreadsheet, Packagist3.10.3OSV
  • phpoffice/phpspreadsheet, Packagist3.10.4OSV
  • phpoffice/phpspreadsheet, Packagist3.10.5OSV
  • phpoffice/phpspreadsheet, Packagist3.10.6OSV
  • phpoffice/phpspreadsheet, Packagist3.3.0OSV
  • phpoffice/phpspreadsheet, Packagist3.4.0OSV
  • phpoffice/phpspreadsheet, Packagist3.5.0OSV
  • phpoffice/phpspreadsheet, Packagist3.6.0OSV
  • phpoffice/phpspreadsheet, Packagist3.7.0OSV
  • phpoffice/phpspreadsheet, Packagist3.8.0OSV
  • phpoffice/phpspreadsheet, Packagist3.9.0OSV
  • phpoffice/phpspreadsheet, Packagist3.9.1OSV
  • phpoffice/phpspreadsheet, Packagist3.9.2OSV
  • phpoffice/phpspreadsheet, Packagist3.9.3OSV
  • phpoffice/phpspreadsheet, Packagistfrom 2.2.0, fixed in 2.4.7OSV
  • phpoffice/phpspreadsheet, Packagist2.2.0OSV
  • phpoffice/phpspreadsheet, Packagist2.2.1OSV
  • phpoffice/phpspreadsheet, Packagist2.2.2OSV
  • phpoffice/phpspreadsheet, Packagist2.3.0OSV
  • phpoffice/phpspreadsheet, Packagist2.3.10OSV
  • phpoffice/phpspreadsheet, Packagist2.3.2OSV
  • phpoffice/phpspreadsheet, Packagist2.3.3OSV
  • phpoffice/phpspreadsheet, Packagist2.3.4OSV
  • phpoffice/phpspreadsheet, Packagist2.3.5OSV
  • phpoffice/phpspreadsheet, Packagist2.3.6OSV
  • phpoffice/phpspreadsheet, Packagist2.3.7OSV
  • phpoffice/phpspreadsheet, Packagist2.3.8OSV
  • phpoffice/phpspreadsheet, Packagist2.3.9OSV
  • phpoffice/phpspreadsheet, Packagist2.4.0OSV
  • phpoffice/phpspreadsheet, Packagist2.4.1OSV
  • phpoffice/phpspreadsheet, Packagist2.4.2OSV
  • phpoffice/phpspreadsheet, Packagist2.4.3OSV
  • phpoffice/phpspreadsheet, Packagist2.4.4OSV
  • phpoffice/phpspreadsheet, Packagist2.4.5OSV
  • phpoffice/phpspreadsheet, Packagist2.4.6OSV
  • phpoffice/phpspreadsheet, Packagistfrom 2.0.0, fixed in 2.1.18OSV
  • phpoffice/phpspreadsheet, Packagist2.0.0OSV
  • phpoffice/phpspreadsheet, Packagist2.1.0OSV
  • phpoffice/phpspreadsheet, Packagist2.1.1OSV
  • phpoffice/phpspreadsheet, Packagist2.1.10OSV
  • phpoffice/phpspreadsheet, Packagist2.1.11OSV
  • phpoffice/phpspreadsheet, Packagist2.1.12OSV
  • phpoffice/phpspreadsheet, Packagist2.1.13OSV
  • phpoffice/phpspreadsheet, Packagist2.1.14OSV
  • phpoffice/phpspreadsheet, Packagist2.1.15OSV
  • phpoffice/phpspreadsheet, Packagist2.1.16OSV
  • phpoffice/phpspreadsheet, Packagist2.1.17OSV
  • phpoffice/phpspreadsheet, Packagist2.1.3OSV
  • phpoffice/phpspreadsheet, Packagist2.1.4OSV
  • phpoffice/phpspreadsheet, Packagist2.1.5OSV
  • phpoffice/phpspreadsheet, Packagist2.1.6OSV
  • phpoffice/phpspreadsheet, Packagist2.1.7OSV
  • phpoffice/phpspreadsheet, Packagist2.1.8OSV
  • phpoffice/phpspreadsheet, Packagist2.1.9OSV
  • phpoffice/phpspreadsheet, Packagistfrom first release, fixed in 1.30.6OSV
  • phpoffice/phpspreadsheet, Packagist1.0.0OSV
  • phpoffice/phpspreadsheet, Packagist1.0.0-betaOSV
  • phpoffice/phpspreadsheet, Packagist1.0.0-beta2OSV
  • phpoffice/phpspreadsheet, Packagist1.1.0OSV
  • phpoffice/phpspreadsheet, Packagist1.10.0OSV
  • phpoffice/phpspreadsheet, Packagist1.10.1OSV
  • phpoffice/phpspreadsheet, Packagist1.11.0OSV
  • phpoffice/phpspreadsheet, Packagist1.12.0OSV
  • phpoffice/phpspreadsheet, Packagist1.13.0OSV
  • phpoffice/phpspreadsheet, Packagist1.14.0OSV
  • phpoffice/phpspreadsheet, Packagist1.14.1OSV
  • phpoffice/phpspreadsheet, Packagist1.15.0OSV
  • phpoffice/phpspreadsheet, Packagist1.16.0OSV
  • phpoffice/phpspreadsheet, Packagist1.17.0OSV
  • phpoffice/phpspreadsheet, Packagist1.17.1OSV
  • phpoffice/phpspreadsheet, Packagist1.18.0OSV
  • phpoffice/phpspreadsheet, Packagist1.19.0OSV
  • phpoffice/phpspreadsheet, Packagist1.2.0OSV
  • phpoffice/phpspreadsheet, Packagist1.2.1OSV
  • phpoffice/phpspreadsheet, Packagist1.20.0OSV
  • phpoffice/phpspreadsheet, Packagist1.21.0OSV
  • phpoffice/phpspreadsheet, Packagist1.22.0OSV
  • phpoffice/phpspreadsheet, Packagist1.23.0OSV
  • phpoffice/phpspreadsheet, Packagist1.24.0OSV
  • phpoffice/phpspreadsheet, Packagist1.24.1OSV
  • phpoffice/phpspreadsheet, Packagist1.25.0OSV
  • phpoffice/phpspreadsheet, Packagist1.25.1OSV
  • phpoffice/phpspreadsheet, Packagist1.25.2OSV
  • phpoffice/phpspreadsheet, Packagist1.26.0OSV
  • phpoffice/phpspreadsheet, Packagist1.27.0OSV
  • phpoffice/phpspreadsheet, Packagist1.27.1OSV
  • phpoffice/phpspreadsheet, Packagist1.28.0OSV
  • phpoffice/phpspreadsheet, Packagist1.29.0OSV
  • phpoffice/phpspreadsheet, Packagist1.29.1OSV
  • phpoffice/phpspreadsheet, Packagist1.29.10OSV
  • phpoffice/phpspreadsheet, Packagist1.29.11OSV
  • phpoffice/phpspreadsheet, Packagist1.29.12OSV
  • phpoffice/phpspreadsheet, Packagist1.29.2OSV
  • phpoffice/phpspreadsheet, Packagist1.29.4OSV
  • phpoffice/phpspreadsheet, Packagist1.29.5OSV
  • phpoffice/phpspreadsheet, Packagist1.29.6OSV
  • phpoffice/phpspreadsheet, Packagist1.29.7OSV
  • phpoffice/phpspreadsheet, Packagist1.29.8OSV
  • phpoffice/phpspreadsheet, Packagist1.29.9OSV
  • phpoffice/phpspreadsheet, Packagist1.3.0OSV
  • phpoffice/phpspreadsheet, Packagist1.3.1OSV
  • phpoffice/phpspreadsheet, Packagist1.30.0OSV
  • phpoffice/phpspreadsheet, Packagist1.30.1OSV
  • phpoffice/phpspreadsheet, Packagist1.30.2OSV
  • phpoffice/phpspreadsheet, Packagist1.30.3OSV

References 3