Threats affecting pkg:composer/friendsoftypo3/tt-address

CVE-2026-8827 is a high-severity SQL Injection vulnerability in the TYPO3 Extension "Address List". The vulnerability arises because the AddressRepository::getSqlQuery() method constructs SQL queries without properly sanitizing user input. However, this method is not called anywhere within the extension by default, so the vulnerability does not pose a direct risk in a default installation. The risk exists if custom extensions invoke this method with untrusted input, potentially exposing the site to SQL injection attacks.