CVE-2026-112238

{
  "etk_id": "ETK-2026-2153",
  "cve_id": "CVE-2026-112238",
  "display_id": "CVE-2026-112238",
  "ghsa_id": "GHSA-7f5c-qwp3-q85h",
  "euvd_id": "EUVD-2026-104867",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in TYPO3 File manager extension",
  "summary": "The TYPO3 File manager extension's file search can mishandle search input and alter database queries. An attacker able to submit searches through the affected functionality may read data from the database.",
  "mitigation": "Upgrade ameos/ameos_filemanager to version 3.1.3. Until upgraded, restrict access to the extension's file-search functionality to trusted users.",
  "vendor": "TYPO3",
  "product": "Extension \"File manager\"",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.1.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.1.3"
      ],
      "package_name": "ameos/ameos_filemanager",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0044,
  "epss_percentile": 0.3726,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 62.583634866666664,
  "t0_at": "2026-10-20T09:30:48.389000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T09:30:48.389000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T09:30:48.389000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112238"
    }
  }
}