Page MenuHomePhabricator

Extension:DataTransfer affected by CVE-2025-54370
Closed, ResolvedPublicSecurity

Description

Hi!

I just found Extension:DataTransfer to be affected by CVE-2025-54370

> composer audit
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpoffice/phpspreadsheet                                                         |
| Severity          | high                                                                             |
| CVE               | CVE-2025-54370                                                                   |
| Title             | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML   |
|                   | document in the browser                                                          |
| URL               | https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rx7m-68vc-p |
|                   | pxh                                                                              |
| Affected versions | <1.30.0|>=2.0.0,<2.1.0|>=2.1.0,<2.1.12|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=3.0.0,<3. |
|                   | 10.0|>=4.0.0,<5.0.0                                                              |
| Reported at       | 2025-08-03T01:06:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Will provide a patch.

Event Timeline

Apparently, it is sufficient to bump the library version to a new minor. None of the interfaces used by the extension has changed.

See https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1190252

sbassett added subscribers: gerritbot, sbassett.

Thanks for the report!

@sbassett Thanks for reviewing. The failing CI tests seem to be unrelated. Looks like a general incompatibility to a DB schema change in MediaWiki Core at master. Could we get this change cherry-picked and merged into REL1_43 as well?

Change #1190252 merged by jenkins-bot:

[mediawiki/extensions/DataTransfer@master] Bump dependency version

https://gerrit.wikimedia.org/r/1190252

Change #1194227 had a related patch set uploaded (by SBassett; author: Robert Vogel):

[mediawiki/extensions/DataTransfer@REL1_44] Bump dependency version

https://gerrit.wikimedia.org/r/1194227

Change #1194228 had a related patch set uploaded (by SBassett; author: Robert Vogel):

[mediawiki/extensions/DataTransfer@REL1_43] Bump dependency version

https://gerrit.wikimedia.org/r/1194228

@sbassett Thanks for reviewing. The failing CI tests seem to be unrelated. Looks like a general incompatibility to a DB schema change in MediaWiki Core at master. Could we get this change cherry-picked and merged into REL1_43 as well?

Sure. I've picked the master patch to 1.44 and 1.43. 1.43 seems to have some version conflicts that git doesn't like, so those will need to be resolved.

Change #1194227 merged by jenkins-bot:

[mediawiki/extensions/DataTransfer@REL1_44] Bump dependency version

https://gerrit.wikimedia.org/r/1194227

Change #1194228 merged by jenkins-bot:

[mediawiki/extensions/DataTransfer@REL1_43] Bump dependency version

https://gerrit.wikimedia.org/r/1194228

sbassett triaged this task as Medium priority.
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.
sbassett removed a project: Patch-For-Review.
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Medium.