Executive brief
The "Forms Export" extension for TYPO3 (a web content management system) fails to properly validate user input in database queries. A backend user with limited privileges and access to the Forms Export module can inject malicious SQL commands, potentially allowing them to read, modify, or delete database records containing sensitive form submission data.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in the "Forms Export" TYPO3 extension (frappant/frp-form-answers). An attacker with low-privileged backend user credentials and read access to the Forms Export backend module can inject arbitrary SQL through a URL parameter. The attack requires network access to the TYPO3 backend and valid backend credentials; no additional user interaction is required. Successful exploitation allows full database confidentiality and integrity compromise. Patches are available in versions 5.0.5, 6.1.3, and 7.1.1, and users should update immediately.
Affected products
- TYPO3 Forms Export 5.0.4 and below, 6.0.0–6.1.2, 7.0.0–7.1.0
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Patches available in versions 5.0.5, 6.1.3, and 7.1.1