Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To assess CVE-2026-100382, first check whether the optional ExternalData extension is installed and enabled, then verify its deployed version. The available reporting identifies ExternalData versions before 3.7 as affected and 3.7 as fixed; a MediaWiki core version alone does not establish exposure. To investigate possible earlier exploitation, correlate suspicious web requests with newly created PHP files and filesystem changes. Treat that pattern as a lead—not a definitive signature or proof of compromise.
Is your MediaWiki installation in scope?
The issue is reported in the optional ExternalData extension, not in MediaWiki core as such. Inventory the extensions actually deployed on each relevant instance and determine whether ExternalData is enabled. Do not infer safety or exposure from the MediaWiki core version alone.
Wikimedia’s surfaced Phabricator search result identifies task T434961 as “CVE-2026-100382: Unauthenticated RCE through wikitext in ExternalData,” with an August 22, 2026 timestamp. That task title identifies the reported issue, but the title by itself does not provide detailed official remediation instructions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the extension’s actual version
A public researcher-authored proof of concept and a secondary report identify versions of ExternalData before 3.7 as affected, with 3.7 described as fixed. Confirm the version deployed on the server rather than relying on a package listing, a source checkout that may not match production, or the MediaWiki version. Also verify the current official package and deployment-specific update instructions before changing a live site.
#1 Best Overall
- Comes with secure packaging
- It can be a gift item
- Easy to read text
What does the reported exploit involve?
The researcher-authored proof of concept describes an OS command-injection path through the ExternalData #get_program_data parser function. It says ExternalData 3.7 disables the relevant execution class by default. Its demonstration is presented by its author as a lab-only, loopback-only test for authorized use; it is evidence of a described reproduction, not evidence that any particular MediaWiki installation was attacked.
Feedly relays a CVSS 4.0 base score of 10.0 attributed to NVD. Because the NVD entry was not directly inspectable in the available material, treat that score as an aggregator-reported severity figure, not as independently verified here. A severity score does not show whether a particular site was reachable or compromised.
How to hunt for possible exploitation
A secondary report proposes looking for a sequence that may include extension-detection requests, a cluster of POST requests to the MediaWiki API, and later GET requests for PHP files that may have been newly created. It recommends correlating access logs with filesystem changes and checking writable, web-served directories. This is a hunting hypothesis, not an official signature or a confirmed pattern that every exploitation attempt must follow.
- Establish scope. Record which instances have ExternalData, whether it is enabled, and the version actually running. Note when the version was deployed or changed if that information is available.
- Choose investigation windows. Review access logs for periods before the extension was updated or disabled, focusing on suspicious activity and sequences of related requests rather than treating a single matching line as a finding.
- Correlate request sequences. Look for potential extension-detection activity, clusters of POST requests to the MediaWiki API, and subsequent requests for PHP files that appear to be newly created. The secondary report’s example filter can surface candidate log lines, but it is not a complete detector.
- Check the host at matching times. Compare request timestamps and paths with file creation or modification times in writable, web-served locations. Account for clock differences and the limits of timestamp evidence; a close match warrants investigation but does not by itself prove who created a file or how.
- Compare deployed files. Check extension and skin directories against a known-good deployment. Preserve relevant logs and suspected files before removing or altering them so that evidence remains available for analysis.
- Escalate corroborated findings. If host evidence supports unauthorized execution or persistence, investigate beyond the extension and its request logs as part of a broader incident response.
Interpret findings cautiously
- A matching API request alone is not a verdict; legitimate activity and unrelated automation can produce suspicious-looking requests.
- A requested PHP file is not necessarily malicious. Establish whether it exists, when it appeared, what it contains, and whether its origin is authorized.
- Missing log entries do not establish that exploitation did not occur. Retention gaps, incomplete logging, or a different request pattern may limit what the logs can show.
- The reported sequence is useful for prioritizing correlation, but the available reporting does not establish it as a universal exploitation pattern.
What to do if the extension is vulnerable
The reported fixed release is ExternalData 3.7. Verify the official current package and instructions for your deployment, then update and confirm the resulting version and enabled state. If an update cannot be applied promptly, disabling the optional extension is reported as an alternative mitigation; first assess which site features depend on it and verify that it is no longer active after the change.
Upgrading or disabling the extension addresses exposure going forward; neither action establishes whether the site was exploited earlier. If investigation confirms unauthorized execution or persistence, preserve evidence, remove confirmed malicious artifacts, check for other unauthorized changes, and assess whether credentials or secrets accessible to the compromised service need rotation. These are general incident-response steps for confirmed server compromise, not CVE-specific instructions attributed to the extension maintainers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to decide whether the evidence warrants incident response
Unpatched exposure is a reason to remediate and review available records, but it is not proof of compromise. A suspicious request is a lead. Evidence becomes more compelling when request timing and paths align with newly created or modified files, the files are unauthorized, or other host evidence supports execution or persistence. Preserve evidence and escalate when those independent signals corroborate one another.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
