TYPO3 File Manager CVE-2026-112238

Exploitation requires reaching the extension's file-search functionality and submitting a crafted search term in which a quote character is not escaped (only LIKE wildcards are escaped), allowing the term to break out of the quoted SQL string value. The flaw affects every searched field, so any searchable input is a candidate injection point. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required and it works against default configurations where the search feature is enabled; the practical limiting factor is that the attacker must be able to reach the search interface (verify whether this is public frontend or authenticated backend). Impact is read-only - no integrity or availability effect per the vector.

This is a CWE-89 SQL injection in the file search of a TYPO3 extension ("File Manager"), scored CVSS 4.0 8.7 (High). The vendor-provided 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact but NO integrity or availability impact - consistent with the description, which explicitly limits the impact to reading data from the database (no data modification or RCE stated). No EPSS score was provided in the input, and there is no CISA KEV listing or POC reference, so exploitation status is: no public exploit identified at time of analysis. The core signals are coherent (network SQLi, unauthenticated, read-only), so this is a genuine priority for anyone running the affected extension, but the absence of KEV/POC/EPSS data means there is no evidence of active or widespread exploitation yet. No SSVC decision data was supplied. The main caveat is scope of reach: the description does not state whether the vulnerable search is exposed on the public frontend or only in an authenticated backend module, which materially changes real-world risk - verify with the TYPO3 advisory (TYPO3-EXT-SA-2026-034).

An attacker submits a crafted file-search term containing an unescaped quote character, breaking out of the intended quoted string value and injecting additional SQL into the query built by the extension. Because the query returns data, the attacker extracts information from arbitrary database tables (e.g., user records or credentials). No public exploit code is identified at this time, and the low attack complexity (AC:L, no user interaction) makes manual exploitation straightforward.