CVE-2026-112238
SQL Injection in extension "File manager" (ameos_filemanager)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
| CWE | CWE-89 |
| Vendor | typo3 |
| Product | extension "file manager" |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for typo3 extension "file manager"
Be the first to know when new unknown vulnerabilities affecting typo3 extension "file manager" are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TYPO3 / Extension "File manager"
0 < 3.1.3
References
Credits
🔍 Tobias Schäfer Raphael Geyer