{"id":"CVE-2026-100242","revision":"69426e9e63dd4e4cb496d0badb24b2a1","records":[{"revision":"69426e9e63dd4e4cb496d0badb24b2a1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100242","aliases":[],"title":"DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)","description":"Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.\n\nThis issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.","state":0,"publishedAt":"2026-09-29T16:40:18.122+00:00","modifiedAt":"2026-10-01T18:13:42.072+00:00","affected":[{"ecosystem":"Vendor product","name":"Mediawiki - DataTransfer Extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Wikimedia Foundation\",\n                    \"product\": \"Mediawiki - DataTransfer Extension\",\n                    \"repo\": \"https://gerrit.wikimedia.org/g/mediawiki/extensions/DataTransfer/+/refs/heads/master\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.46.0\",\n                            \"lessThan\": \"1.47.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://phabricator.wikimedia.org/T433275","https://gerrit.wikimedia.org/r/q/Ibc4a9070c2425b690bc767a882e4c35046a39be7","https://github.com/advisories/GHSA-xh5m-36r6-47m3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100242","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100242","identifiers":["CVE-2026-100242"]},"retained":false,"historicalAffected":[]}],"coverage":[]}