PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8726 TYPO3 CVE debrief

CVE-2026-8726 is a high-severity SQL injection vulnerability in a TYPO3 extension, published 2026-05-19. The flaw stems from improper sanitization of user input before use in database queries. An unauthenticated attacker can inject arbitrary SQL via a URL parameter on pages utilizing the 'Date Menu of news articles' plugin. Exploitation is contingent on two conditions: the plugin must be active, and the TypoScript/Plugin setting `disableOverrideDemand` must not be enabled. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and high confidentiality impact. The vulnerability is classified under CWE-89 (SQL Injection). No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.

Vendor
TYPO3
Product
Extension "News system"
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

TYPO3 administrators, security teams managing content management systems, database administrators, and organizations utilizing news article functionality with date-based navigation.

Technical summary

The vulnerable extension fails to sanitize user-controlled input before incorporating it into database queries within the 'Date Menu of news articles' plugin. Attackers can manipulate URL parameters to inject arbitrary SQL statements. The attack surface is exposed when `disableOverrideDemand` is disabled (default or explicitly unset), allowing external input to override internal demand objects. This represents a classic second-order injection pattern where plugin configuration state determines exploitability.

Defensive priority

HIGH

Recommended defensive actions

  • Verify whether the 'Date Menu of news articles' plugin is deployed in your TYPO3 environment
  • Check TypoScript/Plugin configuration to confirm `disableOverrideDemand` is not enabled
  • Apply patches or updates from the TYPO3 security advisory when available
  • Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in URL parameters
  • Review database query logs for anomalous activity targeting date menu endpoints
  • Conduct code review of custom extensions implementing similar date-based filtering functionality

Evidence notes

Vulnerability description and CVSS vector sourced from NVD record. Advisory reference confirms TYPO3 extension context and exploitation conditions. Vendor identification marked low confidence due to 'Unknown Vendor' classification with TYPO3 as domain candidate.

Official resources

2026-05-19