CVE-2026-8827 SQL Injection in extension "Address List" (tt_address)
SQL injection in TYPO3 Address List extension allows attackers to manipulate database queries if custom code calls the vulnerable method with untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8827?
CVE-2026-8827 is a high-severity SQL injection vulnerability in TYPO3 Extension "Address List", published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
Weakness: CWE-89
Which versions are affected by CVE-2026-8827?
6 open source packages ship an affected version, including friendsoftypo3/tt-address.
| Package | Affected | Fixed in |
|---|---|---|
friendsoftypo3/tt-address Packagist | All versions | 8.1.2 |
friendsoftypo3/tt-address Packagist | All versions | 8.1.2 |
friendsoftypo3/tt-address Packagist | From 10.0.0 | 10.0.1 |
friendsoftypo3/tt-address Packagist | From 10.0.0 | 10.0.1 |
friendsoftypo3/tt-address Packagist | From 9.0.0 | 9.1.1 |
friendsoftypo3/tt-address Packagist | From 9.0.0 | 9.1.1 |
How do I fix CVE-2026-8827?
Upgrade friendsoftypo3/tt-address to a fixed version for your release line: 8.1.2, 10.0.1 or 9.1.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-8827 being exploited?
There is no known exploitation of CVE-2026-8827 in the wild and no public exploit code.
Sources
Also known as GHSA-3h52-6v6j-6wwv.