CVE-2026-8827
CVE-2026-8827 · SQL Injection in extension "Address List" (tt_address)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
CVSS 8.2 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
extension "address list"
- Versions
- ≥ 10.0.0, < 10.0.1: Affected (semver)
- ≥ 9.0.0, < 9.1.1: Affected (semver)
- ≥ 0, < 8.1.2: Affected (semver)
Update to 10.0.1; Update to 8.1.2; Update to 9.1.1
friendsoftypo3/tt-address Packagist
- Versions
- 10.0.0
- Affected ranges
- ECOSYSTEM: ≥ 10.0.0, < 10.0.1
Update to 10.0.1
friendsoftypo3/tt-address Packagist
- Versions
- 9.0.0
- 9.0.1
- 9.1.0
- Affected ranges
- ECOSYSTEM: ≥ 9.0.0, < 9.1.1
Update to 9.1.1
friendsoftypo3/tt-address Packagist
- Versions
- 3.0.0
- 3.0.1
- 3.0.2
- 3.0.3
- 3.1.0
- 3.1.1
- 3.2.0
- 3.2.1
- 4.0.0
- 4.0.1
- 4.1.0
- 4.2.0
- 4.3.0
- 5.0.0
- 5.1.0
- 5.1.1
- 5.1.2
- 5.2.0
- 5.2.1
- 5.3.0
- 6.0.0
- 6.0.1
- 6.1.0
- 7.0.0
- 7.1.0
- 8.0.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.1.0
- 8.1.1
- v3.2.2
- v3.2.3
- v3.2.4
- Affected ranges
- ECOSYSTEM: < 8.1.2
Update to 8.1.2