Mediawiki Datatransfer Extension
Monthly
Denial of service in the MediaWiki DataTransfer extension 1.46.0 through 1.46.x allows remote unauthenticated attackers to exhaust PHP process memory by submitting a tiny malformed .xls/OLE spreadsheet that triggers an unbounded sector-chain loop in the bundled PHPSpreadsheet library's OLERead component. The flaw is reachable through automatic spreadsheet type detection (Reader\Xls::canRead) whenever the extension processes attacker-controlled files; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) confirms no authentication or user interaction is required and that only availability is impacted. Publicly available exploit code exists per SSVC (Exploitation: poc) even though no CISA KEV confirmed exploitation has been reported, and EPSS is low at 0.15% (percentile 4); vendor patches are available, with the extension fixed in 1.47.0 and upstream PHPSpreadsheet fixed in 5.8.1, 3.10.7, 2.4.7, and 2.1.18.
Denial of service in the MediaWiki DataTransfer extension 1.46.0 through 1.46.x allows remote unauthenticated attackers to exhaust PHP process memory by submitting a tiny malformed .xls/OLE spreadsheet that triggers an unbounded sector-chain loop in the bundled PHPSpreadsheet library's OLERead component. The flaw is reachable through automatic spreadsheet type detection (Reader\Xls::canRead) whenever the extension processes attacker-controlled files; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) confirms no authentication or user interaction is required and that only availability is impacted. Publicly available exploit code exists per SSVC (Exploitation: poc) even though no CISA KEV confirmed exploitation has been reported, and EPSS is low at 0.15% (percentile 4); vendor patches are available, with the extension fixed in 1.47.0 and upstream PHPSpreadsheet fixed in 5.8.1, 3.10.7, 2.4.7, and 2.1.18.