PT-2026-41866 · Typo3 · Date Menu Of News Articles

Christian Kuhn + 1 · Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-8726

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions News system (news) (affected versions not specified)

Description The extension fails to properly sanitize user input before using it in a database query. This allows an unauthenticated attacker to perform SQL injection, which is the insertion of malicious SQL code into a query, through a URL parameter on pages utilizing the "Date Menu of news articles" plugin. This issue is exploitable when the "Date Menu of news articles" plugin is active and the TypoScript/Plugin setting disableOverrideDemand is not enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable the TypoScript/Plugin setting disableOverrideDemand to mitigate the risk of exploitation.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8726

GHSA-G868-J3QM-4J28

Affected Products

Date Menu Of News Articles

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/georgringer/news/CVE-2026-8726.yaml · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2026-010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8726 · Security Note
• https://osv.dev/vulnerability/GHSA-g868-j3qm-4j28 · Vendor Advisory
• https://github.com/georgringer/news · Note
• https://t.me/CVEtracker/54231 · Telegram Post