CVE-2026-8827: TYPO3 SQL Injection in extension "Address List" (tt_address)

May 19, 2026 (updated June 29, 2026)

In the TYPO3 extension tt_address, the AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection. This has been patched in version 8.1.2, 9.1.1, and 10.0.1.

References

github.com/FriendsOfPHP/security-advisories/blob/master/friendsoftypo3/tt-address/CVE-2026-8827.yaml
github.com/advisories/GHSA-3h52-6v6j-6wwv
nvd.nist.gov/vuln/detail/CVE-2026-8827
typo3.org/security/advisory/typo3-ext-sa-2026-012

Code Behaviors & Features

Detect and mitigate CVE-2026-8827 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →