PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8827 TYPO3 CVE debrief

A SQL injection vulnerability exists in the AddressRepository::getSqlQuery() method of a TYPO3 extension. The method constructs database queries without proper input sanitization. While the vulnerable method is not invoked within the extension itself—eliminating direct risk in default installations—custom extensions that call this method with untrusted input can expose sites to SQL injection attacks. The vulnerability carries a HIGH severity CVSS 4.0 score of 8.2.

Vendor
TYPO3
Product
Extension "Address List"
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

TYPO3 administrators running custom extensions; developers maintaining TYPO3 extensions that interact with address repositories; security teams monitoring for SQL injection risks in CMS environments

Technical summary

The AddressRepository::getSqlQuery() method in a TYPO3 extension fails to sanitize user input when constructing SQL queries, creating a SQL injection vulnerability (CWE-89). The method is not internally invoked by the extension, so default installations are not directly affected. However, the method's exposure as a public API surface allows custom extensions to invoke it with untrusted input, resulting in potential unauthorized data access. The CVSS 4.0 score of 8.2 reflects network attack vector, low attack complexity, partial attack requirements, no privileges required, no user interaction, and high confidentiality impact to the vulnerable component.

Defensive priority

HIGH

Recommended defensive actions

  • Audit custom TYPO3 extensions for calls to AddressRepository::getSqlQuery() and ensure all input is properly parameterized or sanitized
  • Apply security updates from TYPO3 when available per advisory EXT-SA-2026-012
  • Review database query construction patterns in custom extensions to eliminate string concatenation with user input
  • Enable database query logging to detect anomalous query patterns that may indicate exploitation attempts
  • Consider web application firewall rules to detect SQL injection payloads in requests targeting custom extension endpoints

Evidence notes

CVE published 2026-05-19T10:16:25.887Z; modified 2026-05-19T14:47:13.200Z. NVD status: Deferred. Official advisory reference: TYPO3 EXT-SA-2026-012. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. CWE-89 (SQL Injection) identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8827 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8827

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8827 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8827

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://typo3.org/security/advisory/typo3-ext-sa-2026-012

    f4fb688c-4412-4426-b4b8-421ecf27b14a

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.