Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3
CVE-2026-77137SQL Injection in extension "Forms Export" (frp_form_answers)
High 7.7
In plain English
A high-severity SQL injection in Extension "Forms Export" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "Forms Export" | 7.0.0 – before 7.1.16.0.0 – before 6.1.30 – before 5.0.5 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-027 vendor-advisory