{"id":"CVE-2026-8726","aliases":["EUVD-2026-30861","GHSA-g868-j3qm-4j28"],"status":"published","title":"SQL Injection in extension \"News system\" (news)","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00439,"percentile":0.38559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2026-05-19T09:22:09Z","modified":"2026-10-28T02:31:13Z","exploits":[{"source":"pocgithub","id":"Shentao83/news-8.6.0-cve-2026-8726-backport","title":"Shentao83/news-8.6.0-cve-2026-8726-backport","date":"2026-09-18","url":"https://github.com/Shentao83/news-8.6.0-cve-2026-8726-backport"}],"fixes":[{"ecosystem":"Packagist","package":"georgringer/news","fixed_in":["12.3.2","13.0.2","14.0.3","10.0.4","11.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.0.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.2"}]}],"versions":["12.0.0","12.1.0","12.2.0","12.3.0","12.3.1"]},{"source":"osv","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}],"versions":["13.0.0","13.0.1"]},{"source":"osv","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.0.3"}]}],"versions":["14.0.0","14.0.1","14.0.2"]},{"source":"osv","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.4"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","3.1.0","3.2.0","3.2.1","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.9","4.0.0","4.1.0","4.2.0","4.2.1","4.3.0","4.3.1","4.3.2","5.0.0","5.1.0","5.2.0","5.3.0","5.3.1","5.3.2","5.3.3","6.0.0","6.1.0","6.1.1","6.2.0","6.2.1","6.3.0","7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.1.0","7.2.0","7.2.1","7.2.2","7.2.3","7.3.0","7.3.1","8.0.0","8.1.0","8.1.1","8.2.0","8.3.0","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","9.0.0","9.1.0","9.1.1","9.2.0","9.3.0","9.3.1","9.4.0","9.4.1"]},{"source":"osv","ecosystem":"Packagist","package":"georgringer/news","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.4"}]}],"versions":["11.0.0","11.1.0","11.1.1","11.1.2","11.2.0","11.3.0","11.4.0","11.4.1","11.4.2","11.4.3"]}],"products":[{"vendor":"typo3","product":"extension \"news system\""}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-010","tags":["vendor-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8726","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/georgringer/news/CVE-2026-8726.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g868-j3qm-4j28"},{"url":"https://packagist.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8726.json","tags":["advisory"]},{"url":"https://github.com/georgringer/news","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-8726","title":"SQL Injection in extension \"News system\" (news)","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T09:22:09.037Z","modified":"2026-06-02T17:34:48.804Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-30861","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T09:22:09Z","modified":"2026-06-02T17:34:48Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:55.651138Z"}],"ghsa":[{"id":"GHSA-g868-j3qm-4j28","title":"georgringer/news has SQL Injection in extension \"News system\" (news)","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T12:31:39Z","modified":"2026-06-08T17:52:53Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2026-8726","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T10:16:25.603Z","modified":"2026-10-26T13:10:00.14Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-8726","title":"SQL Injection in extension \"News system\" (news)","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T09:22:09.037Z","modified":"2026-10-28T02:31:13.443013292Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"GHSA-g868-j3qm-4j28","title":"georgringer/news has SQL Injection in extension \"News system\" (news)","description":"The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.","status":"published","published":"2026-05-19T12:31:39Z","modified":"2026-09-10T03:51:05.548810812Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}