CVE-2026-8726
SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
CVE-2026-8726- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-30861
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
EUVD-2026-30861- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g868-j3qm-4j28
georgringer/news has SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
GHSA-g868-j3qm-4j28- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
CVE-2026-8726- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
CVE-2026-8726- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-g868-j3qm-4j28
georgringer/news has SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
- Record
GHSA-g868-j3qm-4j28- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
georgringer/newsPackagist |
12.0.0 up to 12.3.2 | 12.3.2 |
georgringer/newsPackagist |
13.0.0 up to 13.0.2 | 13.0.2 |
georgringer/newsPackagist |
14.0.0 up to 14.0.3 | 14.0.3 |
georgringer/newsPackagist |
before 10.0.4 | 10.0.4 |
georgringer/newsPackagist |
11.0.0 up to 11.4.4 | 11.4.4 |
georgringer/newsPackagist |
12.0.0 up to 12.3.2, plus listed versions 12.1.012.2.012.3.012.3.1 |
12.3.2 |
georgringer/newsPackagist |
13.0.0 up to 13.0.2, plus listed versions 13.0.1 |
13.0.2 |
georgringer/newsPackagist |
14.0.0 up to 14.0.3, plus listed versions 14.0.114.0.2 |
14.0.3 |
georgringer/newsPackagist |
before 10.0.4, plus listed versions 10.0.010.0.110.0.210.0.33.1.0 Show 45 moreShow less3.2.03.2.13.2.33.2.43.2.53.2.63.2.73.2.94.0.04.1.04.2.04.2.14.3.04.3.14.3.25.0.05.1.05.2.05.3.05.3.15.3.25.3.36.0.06.1.06.1.16.2.06.2.16.3.07.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.1.07.2.07.2.17.2.27.2.37.3.07.3.18.0.0 |
10.0.4 |
georgringer/newsPackagist |
11.0.0 up to 11.4.4, plus listed versions 11.1.011.1.111.1.211.2.011.3.0 Show 4 moreShow less11.4.011.4.111.4.211.4.3 |
11.4.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Shentao83/news-8.6.0-cve-2026-8726-backport | 2026-09-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8726 is a high vulnerability (CVSS 8.2) in Typo3 Extension "news System", published May 19, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in georgringer/news 12.3.2.
References
typo3.org/security/advisory/typo3-ext-sa-2026-010
nvd.nist.gov/vuln/detail/CVE-2026-8726
github.com/FriendsOfPHP/security-advisories/blob/master/georgringer/news/CVE-2026-8726.yaml
packagist.org
Left out here: 18 versions. The JSON record has them.