8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8827

CVE-2026-8827: SQL Injection in extension "Address List" (tt_address)

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8827

CVE-2026-8827:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
friendsoftypo3/tt-address	composer	>= 10.0.0, < 10.0.1	10.0.1
friendsoftypo3/tt-address	composer	>= 9.0.0, < 9.1.1	9.1.1
friendsoftypo3/tt-address	composer	< 8.1.2	8.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the getSqlQuery method of the AddressRepository class in the tt_address extension for TYPO3. The method constructs a raw SQL query and, prior to the patch, it manually quoted parameters instead of using the database connection's quoting mechanism. This allowed for SQL injection if a crafted input was passed to the method. The patch, identified in commit f22107e67d51cd30cdca8c62f25235e977d916a2, rectifies this by using $connection->quote($value), which properly escapes the input and mitigates the vulnerability. Although the vulnerable method is not called within the extension itself, any third-party extension using this method would expose the application to SQL injection.

Vulnerable functions

FriendsOfTYPO3\TtAddress\Domain\Repository\AddressRepository::getSqlQuery

Classes/Domain/Repository/AddressRepository.php

The `getSqlQuery` function in the `AddressRepository` class was vulnerable to SQL injection. The vulnerability existed because the function directly used user-provided input (`$value`) within an SQL query without proper sanitization. The patch replaces the insecure string concatenation with the `->quote()` method, which properly escapes the input, thus preventing SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.