Description
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Address List" | 10.0.0 – < 10.0.1, 9.0.0 – < 9.1.1, < 8.1.2 | 10.0.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | friendsoftypo3/tt-address | >= 10.0.0, < 10.0.1 | 10.0.1 | GHSA-3h52-6v6j-6wwv |
| Packagist | friendsoftypo3/tt-address | >= 9.0.0, < 9.1.1 | 9.1.1 | GHSA-3h52-6v6j-6wwv |
| Packagist | friendsoftypo3/tt-address | < 8.1.2 | 8.1.2 | GHSA-3h52-6v6j-6wwv |
Advisories 1
- WID-SEC-2026-1585 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 19, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-012 vendor-advisory