Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-8726

SQL Injection in extension "News system" (news)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "News system"

Default version status: unaffected

  • 14.0.0 to < 14.0.3affected
  • 13.0.0 to < 13.0.2affected
  • 12.0.0 to < 12.3.2affected
  • 11.0.0 to < 11.4.4affected
  • 0 to < 10.0.4affected

References