CVE-2026-112238: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in TYPO3 Extension "File manager"

The TYPO3 Extension "File manager" contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the file search feature builds database query conditions by wrapping the search term in quotes but only escapes wildcard characters (%) and (_) used by the LIKE operator, neglecting to escape quote characters. This allows an attacker to inject SQL code by crafting search terms that break out of the quoted string context, altering the query logic and enabling unauthorized data access. The vulnerability affects all fields that are searched and impacts versions >=0 and <3.1.3 of the extension.

An attacker can exploit this vulnerability to read data from the database without authorization. The flaw allows modification of the intended SQL query logic, potentially exposing sensitive information stored in the database. There is no indication of privilege requirements or user interaction needed, increasing the risk of exploitation. No known exploits in the wild have been reported as of the publication date.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of the TYPO3 Extension "File manager" or restrict access to the search functionality to trusted users only.