CVE-2026-8726: TYPO3 Extension "News system", инжекция

Описание

Оригинално описание

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

Засегнати продукти

• TYPO3 Extension "News system": 14.0.0 преди 14.0.3; 13.0.0 преди 13.0.2; 12.0.0 преди 12.3.2; 11.0.0 преди 11.4.4; преди 10.0.4

Вид слабост

• CWE-89 SQL инжекция

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-8726
• https://nvd.nist.gov/vuln/detail/CVE-2026-8726
• https://typo3.org/security/advisory/typo3-ext-sa-2026-010