GHSA-9895-53fc-98v2
TYPO3 SQL Injection in dbal
A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.
What each source reports
GitHub AdvisoriesNo score
TYPO3 SQL Injection in dbal
A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.
- Record
GHSA-9895-53fc-98v2- Updated
- 2026-11-02
OSVNo score
TYPO3 SQL Injection in dbal
A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.
- Record
GHSA-9895-53fc-98v2- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9895-53fc-98v2 is a vulnerability with no CVSS score yet in typo3/cms, published June 3, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.18.