The MediaWiki DataTransfer Extension depends on the PHPSpreadsheet library, which is affected by CVE-2026-59933. When a large or malformed XLS/OLE file is processed, PHPSpreadsheet can allocate excessive memory, exhausting system resources. The outcome is a denial‑of‑service condition that can prevent the web application from serving legitimate requests or even crash the server if resources are fully consumed.

Sites using Wikimedia Foundation MediaWiki’s DataTransfer Extension, specifically versions from 1.46.0 up through but not including 1.47.0, are impacted. The issue is tied to any installation that has this extension enabled.

Based on the description, it is inferred that the attack vector would involve uploading a crafted Excel file through the extension’s import interface. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is <1%, suggesting exploitation has not yet been observed or is currently low in likelihood. The CVSS score of 7.5 indicates high severity; nevertheless, the potential impact is high; a malicious payload that triggers excessive memory allocation can lead to denial of service, preventing legitimate requests or crashing the server. Because the extension is generally usable by upload‑capable users, the access path is relatively straightforward. No public exploit is currently available, but the lack of a mitigated path increases the risk if the extension remains active.