GHSA-3h52-6v6j-6wwv

Source

https://github.com/advisories/GHSA-3h52-6v6j-6wwv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h52-6v6j-6wwv/GHSA-3h52-6v6j-6wwv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3h52-6v6j-6wwv

Aliases

CVE-2026-8827

Published

2026-05-19T12:31:39Z

Modified

2026-09-10T03:51:04Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

TYPO3 SQL Injection in extension "Address List" (tt_address)

Details

In the TYPO3 extension tt_address, the AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection. This has been patched in version 8.1.2, 9.1.1, and 10.0.1.

Database specific

{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-29T17:40:13Z",
    "nvd_published_at":  "2026-05-19T10:16:25Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / friendsoftypo3/tt-address

Package

Name: friendsoftypo3/tt-address
Purl: pkg:composer/friendsoftypo3/tt-address

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.0.0

Fixed

10.0.1

Affected versions

10.*

10.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h52-6v6j-6wwv/GHSA-3h52-6v6j-6wwv.json"

Packagist / friendsoftypo3/tt-address

Package

Name: friendsoftypo3/tt-address
Purl: pkg:composer/friendsoftypo3/tt-address

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0

Fixed

9.1.1

Affected versions

9.*

9.0.0

9.0.1

9.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h52-6v6j-6wwv/GHSA-3h52-6v6j-6wwv.json"

Packagist / friendsoftypo3/tt-address

Package

Name: friendsoftypo3/tt-address
Purl: pkg:composer/friendsoftypo3/tt-address

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.1.2

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.2.0

3.2.1

v3.*

v3.2.2

v3.2.3

v3.2.4

4.*

4.0.0

4.0.1

4.1.0

4.2.0

4.3.0

5.*

5.0.0

5.1.0

5.1.1

5.1.2

5.2.0

5.2.1

5.3.0

6.*

6.0.0

6.0.1

6.1.0

7.*

7.0.0

7.1.0

8.*

8.0.0

8.0.1

8.0.2

8.0.3

8.1.0

8.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h52-6v6j-6wwv/GHSA-3h52-6v6j-6wwv.json"