GitHub Advisoryadvisory · Packagist

GHSA-3h52-6v6j-6wwv TYPO3 SQL Injection in extension "Address List" (tt_address)

HIGH Published 2026-05-19 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-8827
Ecosystem
Packagist
Packages
friendsoftypo3/tt-address
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-89
Reviewed
2026-06-29

Affected packages

• Packagist friendsoftypo3/tt-address: >= 10.0.0, < 10.0.1 → fixed in 10.0.1 • Packagist friendsoftypo3/tt-address: >= 9.0.0, < 9.1.1 → fixed in 9.1.1 • Packagist friendsoftypo3/tt-address: < 8.1.2 → fixed in 8.1.2

Description

In the TYPO3 extension `tt_address`, the `AddressRepository::getSqlQuery()` method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection. This has been patched in version 8.1.2, 9.1.1, and 10.0.1.

Related

Alias · CVE (1)

  • CVE-2026-8827 The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References