Is CVE-2026-8726 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8726 being exploited in the wild.

How severe is CVE-2026-8726?

High severity, with a CVSS score of 4, published 19 May 2026.

Which products and versions are affected?

georgringer/news (Packagist) ECOSYSTEM:introduced=12.0.0,fixed=12.3.2; Typo3 News system 14.0.0 - 14.0.2, 13.0.0 - 13.0.1, 12.0.0 - 12.3.1, 11.4.3 and below.

Is there a fix for CVE-2026-8726?

Yes. georgringer/news (Packagist): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8726 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8726?

Check whether you run georgringer/news (Packagist) or Typo3 News system at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8726: TYPO3 News system SQL injection in Date Menu plugin

CVE-2026-8726 · Severity: high · CVSS 4 · Published 2026-05-19

The "News system" extension for TYPO3, which is used to manage and display news articles on websites, contains a security vulnerability. An attacker can use a specially crafted web link to access or manipulate database information without needing a password. This could lead to the exposure of sensitive site data or customer information.

Vendors: Packagist, Typo3.

Quick answers

Is CVE-2026-8726 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8726 being exploited in the wild.
How severe is CVE-2026-8726?: High severity, with a CVSS score of 4, published 19 May 2026.
Which products and versions are affected?: georgringer/news (Packagist) ECOSYSTEM:introduced=12.0.0,fixed=12.3.2; Typo3 News system 14.0.0 - 14.0.2, 13.0.0 - 13.0.1, 12.0.0 - 12.3.1, 11.4.3 and below.
Is there a fix for CVE-2026-8726?: Yes. georgringer/news (Packagist): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8726 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8726?: Check whether you run georgringer/news (Packagist) or Typo3 News system at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

georgringer/news (Packagist): upgrade to 12.3.2 or later
```
composer require georgringer/news:^12.3.2
```

Technical details

A SQL injection vulnerability exists in the georgringer/news (News system) extension for TYPO3. The root cause is a failure to properly sanitize user-supplied input before it is used in database queries within the "Date Menu of news articles" plugin. An unauthenticated attacker can trigger this via a malicious URL parameter. Exploitation is contingent upon the "Date Menu" plugin being active and the TypoScript 'disableOverrideDemand' setting not being enabled. Successful exploitation allows for unauthorized data retrieval from the database. Patches are available in versions 10.0.4, 11.4.4, 12.3.2, 13.0.2, and 14.0.3.

Affected products

georgringer news < 10.0.4, >= 11.0.0 < 11.4.4, >= 12.0.0 < 12.3.2, >= 13.0.0 < 13.0.2, >= 14.0.0 < 14.0.3

Identifiers

CVE-2026-8726
GHSA-g868-j3qm-4j28

Timeline

2026-05-19: advisory: Initial disclosure and NVD publication
2026-06-08: other: GitHub Advisory updated with CVSS 4.0 score

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.