CVE-2019-19850
TYPO3 SQL Injection in low-level Query Generator
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
CVE-2019-19850- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2022-2553
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
EUVD-2022-2553- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-59pj-7mjh-4465
TYPO3 SQL Injection in low-level Query Generator
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
GHSA-59pj-7mjh-4465- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
NVD
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
CVE-2019-19850- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
CVE-2019-19850- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-59pj-7mjh-4465
TYPO3 SQL Injection in low-level Query Generator
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
- Record
GHSA-59pj-7mjh-4465- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
8.0 up to 8.7.30 | 8.7.30 |
typo3/cmsPackagist |
9.0 up to 9.5.12 | 9.5.12 |
typo3/cmsPackagist |
10.0 up to 10.2.2 | 10.2.2 |
typo3/cms-corePackagist |
8.0 up to 8.7.30 | 8.7.30 |
typo3/cms-corePackagist |
9.0 up to 9.5.12 | 9.5.12 |
typo3/cms-corePackagist |
10.0 up to 10.2.2 | 10.2.2 |
typo3/cmsPackagist |
8.0 up to 8.7.30, plus listed versions 8.0.08.0.18.1.08.1.18.1.2 Show 40 moreShow less8.2.08.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cmsPackagist |
9.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
typo3/cmsPackagist |
10.0 up to 10.2.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1 |
10.2.2 |
typo3/cms-corePackagist |
8.0 up to 8.7.30, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 18 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cms-corePackagist |
9.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
typo3/cms-corePackagist |
10.0 up to 10.2.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1 |
10.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19850 is a medium vulnerability (CVSS 5.5) in Typo3, published December 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in typo3/cms 8.7.30.