Home

Description

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

PUBLISHED Reserved 2026-05-18 | Published 2026-05-19 | Updated 2026-05-19 | Assigner TYPO3




HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

10.0.0 (semver) before 10.0.1
affected

9.0.0 (semver) before 9.1.1
affected

Any version before 8.1.2
affected

Credits

Georg Ringer reporter

Georg Ringer remediation developer

References

typo3.org/security/advisory/typo3-ext-sa-2026-012 vendor-advisory

cve.org (CVE-2026-8827)

nvd.nist.gov (CVE-2026-8827)

Download JSON