CVE-2026-8827: AddressRepository SQL Injection Vulnerability

CVE-2026-8827 Overview

CVE-2026-8827 is a SQL injection vulnerability in a TYPO3 extension's AddressRepository::getSqlQuery() method. The method constructs database queries without sanitizing user input, allowing attackers to inject arbitrary SQL when the function receives untrusted data. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

The affected method is not invoked anywhere within the extension itself, so default installations are not directly exposed. Risk emerges when custom TYPO3 extensions call getSqlQuery() with untrusted input from external sources.

Critical Impact

Attackers can read, modify, or exfiltrate database contents through custom extensions that pass untrusted input to the vulnerable method, leading to confidentiality loss across the TYPO3 backend.

Affected Products

• TYPO3 extension exposing AddressRepository::getSqlQuery()
• Custom TYPO3 extensions invoking the vulnerable method with untrusted input
• TYPO3 installations integrating the affected extension into custom workflows

Discovery Timeline

• 2026-05-19 - CVE-2026-8827 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8827

Vulnerability Analysis

The AddressRepository::getSqlQuery() method assembles SQL statements through string concatenation rather than parameterized queries. When attacker-controlled input reaches the method, the input becomes part of the executed SQL statement. This allows injection of additional clauses, UNION statements, or stacked queries depending on the database driver.

The vulnerability is reachable only through a secondary code path. The extension itself never calls getSqlQuery() directly. Sites running only the stock extension are not exploitable. Custom or third-party extensions that wire user-controlled values into this method create an exploitable entry point.

The attack vector is network-based and requires no authentication or user interaction once a vulnerable caller exists. Exploitation impact is limited to confidentiality of database contents based on the CVSS 4.0 scoring profile, with no integrity or availability impact reported.

Root Cause

The root cause is missing input sanitization and absence of prepared statements inside getSqlQuery(). The method trusts its caller to deliver safe input, which is an unsafe contract for a public repository API. Standard TYPO3 query building APIs such as QueryBuilder with parameter binding were not used.

Attack Vector

An attacker submits malicious input through any HTTP-facing entry point in a custom extension that forwards values to AddressRepository::getSqlQuery(). Typical payloads include boolean-based, UNION-based, or time-based blind SQL injection strings. The vulnerable method executes the crafted query against the TYPO3 database, returning attacker-controlled result sets to the application.

No verified exploit code is publicly available. See the TYPO3 Security Advisory for technical details on the affected method signature.

Detection Methods for CVE-2026-8827

Indicators of Compromise

• Unusual SQL syntax patterns such as UNION SELECT, SLEEP(, OR 1=1, or comment sequences (--, /*) in HTTP request parameters reaching TYPO3 endpoints
• Database error messages referencing AddressRepository or getSqlQuery in TYPO3 logs
• Anomalous query execution times against the address table from custom extension code paths
• Outbound database connections or DNS lookups originating from query payloads using LOAD_FILE or out-of-band techniques

Detection Strategies

• Inspect TYPO3 extension code for invocations of AddressRepository::getSqlQuery() and trace input sources back to HTTP request handlers
• Deploy web application firewall rules that flag SQL metacharacters in parameters bound for endpoints calling the vulnerable method
• Enable MySQL or MariaDB general query log sampling in staging to surface malformed or attacker-shaped queries during testing

Monitoring Recommendations

• Forward TYPO3 application logs and database error logs to a centralized SIEM for correlation against known SQL injection signatures
• Alert on HTTP 500 responses from extension endpoints accompanied by database driver exceptions
• Monitor for spikes in row reads from the address table outside normal backend usage patterns

How to Mitigate CVE-2026-8827

Immediate Actions Required

• Audit all custom and third-party TYPO3 extensions for calls to AddressRepository::getSqlQuery() and treat any caller passing user input as exploitable
• Apply the vendor-supplied update referenced in the TYPO3 Security Advisory as soon as it is available in your environment
• Restrict TYPO3 backend access to trusted networks while remediation is in progress

Patch Information

Refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-012 for the fixed extension version and upgrade instructions. The patch replaces unsafe query construction with parameterized queries through the TYPO3 QueryBuilder API.

Workarounds

• Remove or stub out custom extension code paths that pass untrusted input to AddressRepository::getSqlQuery() until the patch is applied
• Wrap callers with input validation that rejects SQL metacharacters and enforces strict allow-lists for address-related parameters
• Run TYPO3 database accounts with least privilege, denying FILE, CREATE, and DROP permissions where not required

# Example: grep extension source for vulnerable method usage
grep -rn "AddressRepository::getSqlQuery\|->getSqlQuery(" typo3conf/ext/