CVE-2026-112238

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

• CWE-89

• https://typo3.org/security/advisory/typo3-ext-sa-2026-034

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112214A flaw was found in the GStreamer ASF demuxer in gst-plugins…6.5
• CVE-2026-11222Incorrect security UI in Tab Strip in Google Chrome prior to…6.5
• CVE-2026-112221Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-112222Missing Authorization vulnerability in Surfer Surfer surfers…5.4
• CVE-2026-11223Insufficient validation of untrusted input in Network in Goo…6.5
• CVE-2026-112237The extension provides a public proxy endpoint that fetches …6.9
• CVE-2026-112239The extension provides a backend endpoint that writes a subm…7.2
• CVE-2026-11224Use after free in Chromoting in Google Chrome on Linux prior…8.1
• CVE-2026-112240The download link for files uploaded through a form relied o…6.3
• CVE-2026-112247A weakness has been identified in Wuxi Wubang Security Softw…4.3
• CVE-2026-112248A security vulnerability has been detected in grandnode gran…4.7
• CVE-2026-112249A vulnerability was detected in grandnode grandnode2 up to 2…2.4