CVE-2026-8726: georgringer/news has SQL Injection in extension "News system" (news)

May 19, 2026 (updated June 8, 2026)

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the “Date Menu of news articles” plugin. Exploitation requires the “Date Menu of news articles” plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

References

github.com/FriendsOfPHP/security-advisories/blob/master/georgringer/news/CVE-2026-8726.yaml
github.com/advisories/GHSA-g868-j3qm-4j28
nvd.nist.gov/vuln/detail/CVE-2026-8726
typo3.org/security/advisory/typo3-ext-sa-2026-010

Code Behaviors & Features

Detect and mitigate CVE-2026-8726 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →