CVE-2026-112238 Details
Description
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
A SQL injection vulnerability has been identified in the TYPO3 extension 'File manager' (ameos_filemanager) versions through 3.1.2. The issue arises because the file search feature constructs database query conditions by automatically wrapping the search term in quotes. While wildcard characters used with the LIKE operator are properly escaped, quote characters are not. This oversight allows a crafted search term to break out of the intended string value and manipulate the database query, potentially leading to unauthorized data access.
Users are advised to update the 'File manager' extension to version 3.1.3, available through the TYPO3 extension manager, Packagist, or the TYPO3 extensions website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-034 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| Ameos File manager | <= 3.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |