EUVD-2026-65339
GHSA-3f22-j3m8-gjfq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible URL parameter, low complexity once authenticated; PR:L reflects mandatory low-privileged backend account; no scope change per description.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
AnalysisAI
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two explicit preconditions: (1) the attacker must hold a valid low-privileged TYPO3 backend account (PR:L confirmed by CVSS 4.0 vector), and (2) that account must have at least read access to the 'Forms Export' backend module - this is a non-default module permission that must be explicitly granted by a TYPO3 administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H reflects a network-exploitable, low-complexity flaw requiring only low privileges - but critically, AT:P (Attack Requirements: Present) acknowledges a non-trivial prerequisite: the attacker must already be authenticated as a backend user with access to the specific Forms Export module. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged TYPO3 backend user with access to the Forms Export module navigates to the affected URL and appends a crafted SQL payload to the vulnerable URL parameter - for example, injecting a UNION-based or boolean-blind query to extract the TYPO3 user table including password hashes. With database read and write access confirmed, the attacker could escalate to create a new admin account or exfiltrate all stored form submission data. … |
| Remediation | The primary remediation is to consult and apply the fix referenced in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-027; an exact patched version is not independently confirmed from the available input data - verify the fix version directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all backend users with Forms Export module access and consider disabling the module if not operationally required; review database audit logs for the past 30 days to identify any anomalous SQL queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today