SQL Injection Vulnerability in TYPO3 Database Extension by TYPO3
CVE-2026-112238

8.7HIGH

Key Information:

Vendor

Typo3

Status
Extension "file Manager"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112238?

The TYPO3 Database Extension contains a vulnerability where a crafted search term in the file search can manipulate the database query. The extension improperly handles quote characters in search terms, allowing an attacker to alter database queries and gain unauthorized access to sensitive data. This flaw impacts all searched fields, representing a significant security risk for users of the TYPO3 Database Extension.

Affected Version(s)

Extension "File manager" 0 < 3.1.3

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-034
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tobias Schäfer
Raphael Geyer
.