CVE-2026-8827

SQL Injection in extension "Address List" (tt_address)

8.2 HighFix available

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.33%Up 0.3 points since May 19, 2026

What each source reports

CVE List Score used 8.2

SQL Injection in extension "Address List" (tt_address)

Record: CVE-2026-8827
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2026-30866 8.2

Record: EUVD-2026-30866
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3h52-6v6j-6wwv 8.2

TYPO3 SQL Injection in extension "Address List" (tt_address)

In the TYPO3 extension tt_address, the AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection. This has been patched in version 8.1.2, 9.1.1, and 10.0.1.

Record: GHSA-3h52-6v6j-6wwv
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

NVD 8.2

Record: CVE-2026-8827
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-89
Updated: 2026-11-02

OSV 8.2

SQL Injection in extension "Address List" (tt_address)

Record: CVE-2026-8827
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

OSVGHSA-3h52-6v6j-6wwv 8.2

TYPO3 SQL Injection in extension "Address List" (tt_address)

Record: GHSA-3h52-6v6j-6wwv
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

Affected products

typo3 extension "address list"

Affected packages

Affected packages
Package	Affected	Fixed
`friendsoftypo3/tt-address` Packagist	10.0.0 up to 10.0.1	10.0.1
`friendsoftypo3/tt-address` Packagist	9.0.0 up to 9.1.1	9.1.1
`friendsoftypo3/tt-address` Packagist	before 8.1.2	8.1.2
`friendsoftypo3/tt-address` Packagist	9.0.0 up to 9.1.1, plus listed versions 9.0.19.1.0	9.1.1
`friendsoftypo3/tt-address` Packagist	before 8.1.2, plus listed versions 3.0.03.0.13.0.23.0.33.1.0 Show 29 moreShow less 3.1.13.2.03.2.14.0.04.0.14.1.04.2.04.3.05.0.05.1.05.1.15.1.25.2.05.2.15.3.06.0.06.0.16.1.07.0.07.1.08.0.08.0.18.0.28.0.38.1.08.1.1v3.2.2v3.2.3v3.2.4	8.1.2

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-8827 is a high vulnerability (CVSS 8.2) in Typo3 Extension "address List", published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in friendsoftypo3/tt-address 10.0.1.