CVE-2026-8726

Name of the Vulnerable Software and Affected Versions News system (news) (affected versions not specified)

Description The extension fails to properly sanitize user input before using it in a database query. This allows an unauthenticated attacker to perform SQL injection, which is the insertion of malicious SQL code into a query, through a URL parameter on pages utilizing the "Date Menu of news articles" plugin. This issue is exploitable when the "Date Menu of news articles" plugin is active and the TypoScript/Plugin setting disableOverrideDemand is not enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable the TypoScript/Plugin setting disableOverrideDemand to mitigate the risk of exploitation.