CVE-2026-77137: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in TYPO3 Extension "Forms Export"

The TYPO3 Extension "Forms Export" fails to properly neutralize special elements used in SQL commands, leading to an SQL injection vulnerability (CWE-89). This allows a low-privileged backend user with read access to the "Forms Export" backend module to inject arbitrary SQL via a URL parameter. The vulnerability affects versions <5.0.5, >=6.0.0 <6.1.3, and >=7.0.0 <7.1.1, including exact versions 6.0.0 and 7.0.0. The CVSS 4.0 score is 7.7, indicating high severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild.

Successful exploitation could allow a low-privileged backend user to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification within the TYPO3 environment. The impact is limited by the requirement for backend access and read permissions to the "Forms Export" module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict backend user permissions to minimize exposure and avoid granting unnecessary access to the "Forms Export" backend module.