CVE-2026-8726: Date Menu Plugin SQL Injection Vulnerability

CVE-2026-8726 Overview

CVE-2026-8726 is a SQL injection vulnerability [CWE-89] affecting a TYPO3 extension that implements the "Date Menu of news articles" plugin. The extension fails to sanitize user input before incorporating it into database queries. Unauthenticated attackers can inject arbitrary SQL through a URL parameter on pages rendering the affected plugin. Exploitation requires the plugin to be active and the TypoScript setting disableOverrideDemand to remain disabled.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the TYPO3 database, exposing confidential data stored in the content management system.

Affected Products

TYPO3 extension implementing the "Date Menu of news articles" plugin
Installations where the disableOverrideDemand TypoScript setting is not enabled
TYPO3 sites rendering the Date Menu plugin on public-facing pages

Discovery Timeline

2026-05-19 - CVE-2026-8726 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8726

Vulnerability Analysis

The vulnerability resides in the request handling logic for the "Date Menu of news articles" plugin. The extension reads a URL parameter that controls date-based filtering of news entries. This value flows directly into a database query without parameterization or input validation. The flaw allows attackers to break out of the intended query context and append arbitrary SQL clauses.

The condition for exploitation is narrow but common in default deployments. The TypoScript flag disableOverrideDemand must remain in its default state, which permits frontend requests to override demand parameters. When enabled, this setting blocks the tainted input path and neutralizes the attack surface.

The vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. Because the affected endpoint is reachable over the network without authentication, attackers require only knowledge of a vulnerable page URL to begin probing.

Root Cause

The extension concatenates attacker-controlled URL parameter data into SQL statements rather than using prepared statements or query builder bindings. TYPO3's framework provides safe query construction primitives, but the affected plugin code bypasses them when handling demand override parameters.

Attack Vector

An attacker crafts an HTTP GET request to a page that embeds the Date Menu plugin. The malicious URL parameter contains SQL syntax that alters the original query, such as UNION-based payloads to exfiltrate data from other tables. No user interaction or authentication is required. The vulnerability mechanism is documented in the TYPO3 Security Advisory.

Detection Methods for CVE-2026-8726

Indicators of Compromise

HTTP requests to pages containing the Date Menu plugin with URL parameters containing SQL keywords such as UNION, SELECT, SLEEP, or --
Database error messages in TYPO3 logs correlated with frontend requests carrying demand override parameters
Unexpected query patterns in MySQL or MariaDB slow query logs originating from the news extension
Outbound data transfer spikes from the web server following crafted requests to news listing pages

Detection Strategies

Deploy web application firewall rules that flag SQL metacharacters in URL parameters targeting TYPO3 news pages
Audit TYPO3 access logs for malformed or suspiciously encoded values on parameters consumed by the Date Menu plugin
Enable MySQL general query logging temporarily to identify queries containing concatenated attacker payloads

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation
Alert on repeated HTTP 500 responses from URLs hosting the Date Menu plugin, which often indicate injection probing
Track query execution time anomalies that may indicate time-based blind SQL injection attempts

How to Mitigate CVE-2026-8726

Immediate Actions Required

Update the affected TYPO3 extension to the patched version listed in the TYPO3 Security Advisory
Enable the disableOverrideDemand TypoScript setting on all instances of the Date Menu plugin as an interim control
Review TYPO3 database accounts and rotate credentials if injection activity is suspected

Patch Information

Refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-010 for the fixed extension versions. Apply the update through the TYPO3 Extension Manager or via Composer for production deployments.

Workarounds

Set plugin.tx_news.settings.disableOverrideDemand = 1 in TypoScript configuration to block the vulnerable input path
Restrict access to pages embedding the Date Menu plugin through firewall or reverse proxy rules until patching is complete
Apply database least-privilege principles so the TYPO3 service account cannot read or modify unrelated schemas

bash

# TypoScript workaround example
plugin.tx_news.settings.disableOverrideDemand = 1