Which versions of TYPO3 news extension are affected by CVE-2026-8726?

The TYPO3 news extension's 'Date Menu' plugin contains a SQL injection vulnerability (CVE-2026-8726) that allows unauthenticated attackers to access and manipulate database contents through URL…. A patch is available.

How to fix or mitigate CVE-2026-8726?

Within 24 hours: Audit all TYPO3 deployments to identify instances running the news extension with the 'Date Menu of news articles' plugin enabled. Within 7 days: Disable the vulnerable plugin component or enable the disableOverrideDemand TypoScript configuration setting to block parameter injection. Within 30 days: Subscribe to TYPO3 security advisories, establish patch testing procedures, and prepare deployment timeline when vendor releases a fix.

TYPO3 news extension CVE-2026-8726

Q: What is the CVSS score of CVE-2026-8726?

CVE-2026-8726 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30861 HIGH

SQL Injection (CWE-89)

2026-05-19 TYPO3

GHSA-g868-j3qm-4j28

SQLi Extension News System

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 19, 2026 - 11:16 EUVD

Analysis Generated

May 19, 2026 - 10:46 vuln.today

CVSS changed

May 19, 2026 - 10:22 NVD

8.2 (HIGH)

DescriptionCVE.org

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

AnalysisAI

SQL injection in the TYPO3 'news' extension allows unauthenticated remote attackers to inject arbitrary SQL through a URL parameter on pages that render the 'Date Menu of news articles' plugin. The flaw stems from missing sanitization of user input before it reaches a database query, and exposure is limited to sites that both use the affected plugin and have not enabled the TypoScript/plugin setting disableOverrideDemand. No public exploit identified at time of analysis.

Technical ContextAI

TYPO3 is a PHP-based enterprise CMS, and the 'news' extension (per CPE cpe:2.3:a:typo3:extension_"news_system":*) is one of its most widely deployed third-party extensions for editorial content. The vulnerable code path is the 'Date Menu of news articles' plugin, which renders archive navigation by date and accepts filter values from URL parameters. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) applies: the extension concatenates or otherwise embeds attacker-controlled input into a query without parameterization or type-casting, allowing the input to break out of its intended SQL context. The disableOverrideDemand TypoScript setting normally restricts which Demand object properties (the news extension's query-shaping abstraction) can be overridden from request input - when not enabled, the vulnerable parameter remains reachable.

RemediationAI

Patch available per vendor advisory - consult https://typo3.org/security/advisory/typo3-ext-sa-2026-010 (TYPO3-EXT-SA-2026-010) for the fixed release of the news extension and upgrade via Composer or the Extension Manager to that version; the input data does not include a specific fix version, so cite the advisory's listed release rather than guessing. As an interim compensating control, set the TypoScript/plugin option disableOverrideDemand = 1 for the news plugin, which the advisory itself identifies as blocking the vulnerable code path (side effect: any legitimate use of request-driven Demand overrides on that site stops working, so editorial date filters driven by GET parameters may need to be reimplemented server-side). If the 'Date Menu of news articles' plugin is not actively used, remove its inclusion from page templates or unregister the plugin entirely. Web application firewall rules that reject SQL metacharacters on the relevant URL parameter can reduce drive-by exploitation but should be treated as a stopgap, not a substitute for upgrading.