Extension File Manager
Monthly
Unauthenticated SQL injection in TYPO3 File Manager allows remote attackers to read database contents through crafted file-search terms, per the CVSS vector's PR:N/UI:N conditions. The extension wraps the search term in quotes but escapes only LIKE wildcards, so an unescaped quote can break out of the quoted value across every searchable field. Impact is confidentiality-only per the independent assessment, and no public exploit is identified at time of analysis; the TYPO3 advisory is the reference for affected and fixed releases.
Unauthenticated SQL injection in TYPO3 File Manager allows remote attackers to read database contents through crafted file-search terms, per the CVSS vector's PR:N/UI:N conditions. The extension wraps the search term in quotes but escapes only LIKE wildcards, so an unescaped quote can break out of the quoted value across every searchable field. Impact is confidentiality-only per the independent assessment, and no public exploit is identified at time of analysis; the TYPO3 advisory is the reference for affected and fixed releases.