Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-8827

SQL Injection in extension "Address List" (tt_address)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "Address List"

Default version status: unaffected

  • 10.0.0 to < 10.0.1affected
  • 9.0.0 to < 9.1.1affected
  • 0 to < 8.1.2affected

References