MediaWiki ExternalData EUVD-2026-87348

Requires the target wiki to run the MediaWiki ExternalData extension at a version before 3.7 AND to have a command/program-executing external data source configured (the extension's feature that invokes local programs, e.g. via $wgExternalDataSources). The attacker must be able to supply input that flows into that command - typically through wiki markup/parser functions that pass parameters to the external program. Limiting factors: ExternalData is an optional extension not present on default MediaWiki installs, and the exec data-source capability must be explicitly enabled by an operator; on wikis that restrict page editing, invocation may also require edit privileges, narrowing the PR:N claim. Where these conditions hold, exploitation is remote and low-complexity.

The vendor-supplied CVSS 4.0 vector scores this a perfect 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H), which describes an unauthenticated, network-reachable, low-complexity OS command injection yielding full compromise of the host beyond the application boundary - the maximum-severity profile for CWE-78. That top-line score should be tempered against real-world signals: there is no EPSS probability, no CISA KEV listing, and no public POC referenced, so exploitation is currently theoretical rather than observed. A vendor patch (Gerrit 1326012, tracked in Phabricator T434961) is confirmed available, which is the single most actionable fact. Note a tension in the PR:N claim: the ExternalData extension only executes local programs when an operator has configured the exec/program data-source feature ($wgExternalDataSources), so real-world reachability is gated on that non-default configuration and, on many wikis, on the ability to invoke it via editable wiki markup - meaning the effective exploit population is narrower than a raw 10.0 implies. Verdict: genuinely high-impact and worth prompt patching where ExternalData is installed, but the absence of exploitation evidence plus the configuration gate makes it a high-priority-patch rather than a confirmed emergency.

A remote attacker reaches a MediaWiki instance running the ExternalData extension (before 3.7) with a program/command data source configured, and supplies crafted input containing shell metacharacters that is passed unneutralized into an OS command. The command executes on the web server, giving arbitrary code execution as the web-server user and, per the CVSS subsequent-system metrics, full host compromise. No public exploit identified at time of analysis, and no CISA KEV or EPSS data is available.