Vulnerability · Published May 19, 2026 · Assigned by TYPO3
CVE-2026-8726SQL Injection in extension "News system" (news)
High 8.2
In plain English
A high-severity SQL injection in Extension "News system" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | georgringer/news | 12.3.2 | GHSA-g868-j3qm-4j28 |
| Packagist | georgringer/news | 13.0.2 | GHSA-g868-j3qm-4j28 |
| Packagist | georgringer/news | 14.0.3 | GHSA-g868-j3qm-4j28 |
| Packagist | georgringer/news | 10.0.4 | GHSA-g868-j3qm-4j28 |
| Packagist | georgringer/news | 11.4.4 | GHSA-g868-j3qm-4j28 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "News system" | 14.0.0 – before 14.0.313.0.0 – before 13.0.212.0.0 – before 12.3.211.0.0 – before 11.4.40 – before 10.0.4 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-010 vendor-advisory