{"id":"CVE-2026-112238","kind":"vulnerability","aliases":["CVE-2026-112238"],"related":[],"title":"Browser extension file search lets crafted terms read the database","description":"The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.","summary":"SQL injection (CWE-89) in the file search of the TYPO3 extension File manager (ameos/ameos_filemanager), versions 3.1.2 and below. The search term is wrapped in quotes by the extension and only LIKE wildcards are escaped, so a crafted term can read any data from the database across all searched fields. No authentication required per CVSS 4.0 vector. Fixed in 3.1.3.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ameos/ameos_filemanager","fixed":["3.1.3"],"affected":"<= 3.1.2","ecosystem":"packagist"}],"ecosystems":[],"tags":["database-backed-apps","extension-users","other","php","self-hosted","sql-injection","typo3","typo3-extension"],"not_affected_if":["ameos_filemanager-not-installed","parameterized-queries-in-use","search-feature-unused","version-3.1.3-or-later"],"how_to_check":"Run 'composer show ameos/ameos_filemanager' or check the Extension Manager in the TYPO3 backend; any version <= 3.1.2 is affected.","fix":"Update ameos/ameos_filemanager to 3.1.3 (composer update ameos/ameos_filemanager, the TYPO3 extension manager, or extensions.typo3.org).","status":"open","published_at":"2026-10-20T10:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:37:23+00:00","updated_at":"2026-10-24T00:16:00+00:00","category":"other","confidence":0.95,"triage":{"at":"2026-10-23T22:37:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Browser extension file search lets crafted terms read the database","impact":"medium","summary":"The extension's file search builds SQL conditions by wrapping the search term in quotes itself and escapes only LIKE wildcards, not quote characters. An attacker who supplies a crafted search term can break out of the string value and change the database query to read data.","category":"other","who_cares":["extension-users","database-backed-apps"],"confidence":0.4,"needs_auth":"unknown","worst_case":"attacker reads database contents through crafted search terms","analyst_note":"Sources do not name the extension, its versions, or the fixed release; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112238 for the product and patched version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["search-feature-unused","parameterized-queries-in-use"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2906,"output_tokens":360,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name the extension, its versions, or the fixed release; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112238 for the product and patched version.","search":"'-112238':13A,16A '-2026':12A,15A '-89':40B '3.1.2':53B '3.1.3':96B '4.0':92B 'across':83B 'affect':157C 'allow':146C 'ameos/ameos_filemanager':17A,51B 'app':21B 'attack':148C 'authent':88B 'back':20B 'browser':1A 'build':103C 'chang':141C 'charact':118C,126C 'condit':106C 'craft':6A,74B,130C 'cve':11A,14A 'cvss':91B 'cwe':39B 'data':79B,151C 'databas':10A,19B,82B,105C,143C,154C 'database-backed-app':18B 'escap':71B,124C 'everi':158C 'extens':2A,23B,36B,48B,65B,102C 'extension-us':22B 'field':86B,160C 'file':3A,43B,49B,98C 'fix':94B 'host':29B 'inject':32B,38B 'intend':137C 'issu':156C 'leav':135C 'let':5A 'like':68B,121C 'manag':50B 'oper':122C 'per':90B 'php':26B 'queri':144C 'quot':62B,113C,125C 'read':8A,77B,150C 'requir':89B 'search':4A,44B,57B,85B,99C,110C,131C,159C 'self':28B 'self-host':27B 'sql':31B,37B 'sql-inject':30B 'string':138C 'term':7A,58B,75B,111C,132C 'therefor':134C 'typo3':33B,35B,47B 'typo3-extension':34B 'user':24B 'valu':139C 'vector':93B 'version':52B 'wildcard':69B,117C 'wrap':60B,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112238","severity":null,"published_at":"2026-10-20T10:17:04+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112238:623","url":null,"severity":null,"published_at":"2026-10-24T00:16:00+00:00","modified_at":"2026-10-24T00:16:00+00:00","first_seen_at":"2026-10-24T00:16:00+00:00","fetched_at":"2026-10-24T00:16:00+00:00","note":"Primary source TYPO3-EXT-SA-2026-034: TYPO3 extension ameos_filemanager <=3.1.2, fixed 3.1.3. No PoC or exploitation found (Feedly/Panop); no social search done."}],"documents":[{"id":2514,"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-034","title":"TYPO3-EXT-SA-2026-034: SQL Injection in ameos_filemanager","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}