CVE-2026-8726

SQL Injection in extension "News system" (news)

State: Published
Severity: 8.2 High
Published: May 19, 2026
Updated: Jun 2, 2026
Reserved: May 16, 2026

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Extension "News system"TYPO3	14.0.0 to before 14.0.3Affected 13.0.0 to before 13.0.2Affected 12.0.0 to before 12.3.2Affected 11.0.0 to before 11.4.4Affected before 10.0.4Affected

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-010vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.