---
id: "CVE-2026-112238"
kind: "vulnerability"
aliases: ["CVE-2026-112238"]
title: "Browser extension file search lets crafted terms read the database"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ameos/ameos_filemanager", "fixed": ["3.1.3"], "affected": "<= 3.1.2", "ecosystem": "packagist"}]
ecosystems: []
tags: ["database-backed-apps", "extension-users", "other", "php", "self-hosted", "sql-injection", "typo3", "typo3-extension"]
not_affected_if: ["ameos_filemanager-not-installed", "parameterized-queries-in-use", "search-feature-unused", "version-3.1.3-or-later"]
published_at: "2026-10-20T10:17:04+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:16:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112238", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:16:00+00:00"}]
---

# Browser extension file search lets crafted terms read the database

SQL injection (CWE-89) in the file search of the TYPO3 extension File manager (ameos/ameos_filemanager), versions 3.1.2 and below. The search term is wrapped in quotes by the extension and only LIKE wildcards are escaped, so a crafted term can read any data from the database across all searched fields. No authentication required per CVSS 4.0 vector. Fixed in 3.1.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:ameos/ameos_filemanager affected <= 3.1.2 fixed 3.1.3

## How to check

Run 'composer show ameos/ameos_filemanager' or check the Extension Manager in the TYPO3 backend; any version <= 3.1.2 is affected.

## Fix

Update ameos/ameos_filemanager to 3.1.3 (composer update ameos/ameos_filemanager, the TYPO3 extension manager, or extensions.typo3.org).

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112238
- 2026-10-24T00:16:00+00:00 analyst — Primary source TYPO3-EXT-SA-2026-034: TYPO3 extension ameos_filemanager <=3.1.2, fixed 3.1.3. No PoC or exploitation found (Feedly/Panop); no social search done.

## Documents

- [advisory] TYPO3-EXT-SA-2026-034: SQL Injection in ameos_filemanager https://typo3.org/security/advisory/typo3-ext-sa-2026-034

## From the sources

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_