CVE-2026-100382: unauthenticated RCE in MediaWiki External Data extension

A critical unauthenticated remote code execution flaw in MediaWiki's External Data extension, tracked as CVE-2026-100382 with a CVSS score of 10.0, affects all releases before 3.7. Bots began exploiting it within a day of disclosure, dropping web shells into the skins directory. ZoomEye found 1,128 assets referencing External Data.

• CVSS v4 score of 10.0; public exploit details and PoC in Phabricator task T434961
• Attack runs in three phases: API recon, POST payload delivery, web shell retrieval
• All External Data releases before 3.7 are affected on any MediaWiki build
• Remediation requires rotating DB and secret keys and removing shells, not just patching