CVE-2026-10038210.0CriticalCWE-78
CVE-2026-100382: Unauthenticated remote code execution through wikitext in ExternalData
Wikimedia Foundation · Mediawiki - ExternalData Extension
Fixed in 3.7 · Affected: Wikimedia Foundation Mediawiki - ExternalData Extension before 3.7 · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub27 Sep
- Not established: not seen
1.2%probability of exploitation in the next 30 days
69th percentile
050100
Higher than 69% of scored CVEs
10.0CriticalCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Wikimedia Foundation
- Published
- September 2026
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 1 Oct.
- MediaWiki Extension Flaw Lets Attackers Deploy Web ShellsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.