MediaWiki DataTransfer EUVD-2026-89081

Exploitation requires that the MediaWiki instance runs the DataTransfer extension (1.46.0-1.46.x) and exposes a path that accepts attacker-controlled spreadsheet files, so that PHPSpreadsheet's IOFactory/automatic format detection invokes Reader\Xls::canRead() → OLERead::read(). The trigger is a malformed .xls/OLE file whose small-block-depot (or other) sector chain references a previously visited sector (e.g., sector 0 mapping to sector 0), causing an unbounded chain-walk loop with no cycle detection or iteration cap. No authentication is indicated by the CVSS vector (PR:N) and no user interaction is required (UI:N); the primary limiting factor is whether untrusted users can actually submit spreadsheets to the import/detection pipeline, and whether PHP memory_limit and process isolation bound the blast radius. Fixed in extension 1.47.0 (upstream PhpSpreadsheet fixes include 5.8.1/3.10.7/2.4.7/2.1.18).

This is a denial-of-service vulnerability (CWE-1395, dependency on a vulnerable third-party component - PHPSpreadsheet's OLERead) whose CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 HIGH) reflects a pure availability impact with no confidentiality or integrity loss. Signals are largely consistent in pointing to a real-but-moderate concern rather than an urgent one: SSVC marks Exploitation as 'poc', Automatable 'yes', and Technical Impact 'partial', and a detailed GHSA advisory (GHSA-xh5m-36r6-47m3) with a proof-of-concept confirms a 1 KiB malformed XLS/OLE file triggers unbounded memory allocation. However, EPSS is only 0.15% (4th percentile), it is NOT listed in CISA KEV, and there is no evidence of active exploitation, so real-world mass exploitation probability is currently low. A notable conflict exists in the metadata: the issue is tagged 'Information Disclosure', but the CVSS vector sets C:N/I:N with A:H and the advisory describes memory exhaustion only - this is a DoS, not information disclosure, so the tag is mislabeled. Also note the 'network, no-interaction' rating assumes the application exposes attacker-controlled spreadsheet upload/import; the DataTransfer extension's import functionality makes this plausible by design, but exploitability depends on whether that import path is reachable by untrusted users - verify per deployment.

An attacker uploads a tiny (~1 KiB) malformed .xls/OLE file to a MediaWiki instance whose DataTransfer extension imports spreadsheets, where PHPSpreadsheet's automatic format detection calls OLERead::read(). The crafted small-block-depot sector chain points back to itself, so the reader appends the same sector data in an infinite loop until the PHP process exhausts memory and the request (and potentially the worker) crashes. A public proof-of-concept exists in the GHSA advisory demonstrating the self-looping sector chain.