Vulnerability · Published May 19, 2026 · Assigned by TYPO3

CVE-2026-8827SQL Injection in extension "Address List" (tt_address)

High 8.2

In plain English

A high-severity SQL injection in Extension "Address List" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	friendsoftypo3/tt-address	10.0.1	GHSA-3h52-6v6j-6wwv
Packagist	friendsoftypo3/tt-address	9.1.1	GHSA-3h52-6v6j-6wwv
Packagist	friendsoftypo3/tt-address	8.1.2	GHSA-3h52-6v6j-6wwv

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Address List"	10.0.0 – before 10.0.19.0.0 – before 9.1.10 – before 8.1.2

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-012 vendor-advisory