All vulnerabilities
CVE-2026-100382

Unauthenticated remote code execution through wikitext in ExternalData

Wikimedia Foundation Mediawiki - ExternalData ExtensionApplications & CMS
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.95%Chance of exploitation activity in the next 30 days, higher than 60% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7Fixed versionCVE List
Published25 Sep 2026Updated 26 Sep 2026CVE List

What fixes it

  • 3.7Mediawiki - ExternalData ExtensionCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection.

This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

Text from CVE List

Affected versions 1

  • Mediawiki - ExternalData Extensionaffected: * before 3.7CVE List

References 2