Live › vulnerability › CVE-2026-112238
Go to dashboardSQL injection (CWE-89) in the file search of the TYPO3 extension File manager (ameos/ameos_filemanager), versions 3.1.2 and below. The search term is wrapped in quotes by the extension and only LIKE wildcards are escaped, so a crafted term can read any data from the database across all searched fields. No authentication required per CVSS 4.0 vector. Fixed in 3.1.3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ameos/ameos_filemanager | packagist | <= 3.1.2 | 3.1.3 |
Run composer show ameos/ameos_filemanager or check the Extension Manager in the TYPO3 backend; any version <= 3.1.2 is affected.
Update ameos/ameos_filemanager to 3.1.3 (composer update ameos/ameos_filemanager, the TYPO3 extension manager, or extensions.typo3.org).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
This page as .md · .json · in your agent: get_signal("CVE-2026-112238")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.