CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.

• CWE-89

• https://typo3.org/security/advisory/typo3-ext-sa-2026-027

Published

Aug 25, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77131When OpenSSL is unavailable on the server, the extension tra…5.3
• CVE-2026-77132It has been discovered that several AJAX routes used for the…5.3
• CVE-2026-77133The extension fails to restrict which frontend usergroups a …6
• CVE-2026-77134The extension fails to require the dedicated admin confirmat…8.3
• CVE-2026-77135The extension's user detail view fails to verify that a requ…8.2
• CVE-2026-77136The extension passes the raw value of a form field configure…9.5
• CVE-2026-77138The extension fails to safely process untrusted client input…9.3
• CVE-2026-77139The extension fails to validate a client-supplied template e…6
• CVE-2026-7714A flaw has been found in crocodilestick Calibre-Web-Automate…6.5
• CVE-2026-77140The extension validates the HMAC of a frontend employee edit…8.7
• CVE-2026-77141The extension resolves the targeted club record from a user-…8.8
• CVE-2026-77142The frontend company self-service editing feature relies on …8.8