Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
news-8.6.0-cve-2026-8726-backport — Minimal security backport for CVE-2026-8726 in georgringer/news 8.6.0 | Kitploit
Tools/GitHubGitHub/shentao83/news-8.6.0-cve-2026-8726-backport
Defensive ToolsStatic Code Analysis (SAST)Vulnerability AnalysisWeb Application ExploitationWeb SecurityDatabase Security
GitHubshentao83/news-8.6.0-cve-2026-8726-backport

news-8.6.0-cve-2026-8726-backport

Minimal security backport for CVE-2026-8726 in georgringer/news 8.6.0

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
20h 14m agoNot yet reviewed
Share

Security backport for georgringer/news 8.6.0

This repository contains a minimal backport for CVE-2026-8726 / TYPO3-EXT-SA-2026-010, a high-severity SQL injection vulnerability in the TYPO3 extension georgringer/news.

It is intended only for installations that must temporarily remain on news 8.6.0. The supported fix is to upgrade the extension to a maintained version. This patch is based on the upstream security changes released in news 10.0.4.

Affected versions

The TYPO3 advisory lists all news versions through 10.0.3 as affected. The attack path involves user-controlled demand parameters used with the Date Menu plugin. No authentication is required.

  • Advisory: https://news.typo3.com/security/advisory/typo3-ext-sa-2026-010
  • CVE: https://www.cve.org/CVERecord?id=CVE-2026-8726
  • Upstream fix: https://github.com/georgringer/news/compare/10.0.3...10.0.4

What the patch changes

The patch changes only two repository classes:

  1. It quotes non-numeric query values through Doctrine's active connection rather than placing them into SQL with manually assembled single quotes.
  2. It quotes the date field as an SQL identifier before using it in the Date Menu query.

It deliberately does not include unrelated changes from the upstream release.

Installation

Run the commands from the root of your news extension, not the TYPO3 project root. Create a backup first and test the patch before applying it.

root@kitploit:~
cd typo3conf/ext/news
backup_dir=".security-backups/cve-2026-8726-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$backup_dir"
cp Classes/Domain/Repository/AbstractDemandedRepository.php \
   Classes/Domain/Repository/NewsRepository.php "$backup_dir"/

patch --dry-run -p1 < /path/to/news-8.6.0-cve-2026-8726.patch
patch -p1 < /path/to/news-8.6.0-cve-2026-8726.patch

Then clear TYPO3's caches. For old non-Composer TYPO3 installations this can be done by removing the contents of typo3temp/var/cache/; use the TYPO3 CLI if it is available in your installation.

Verification

root@kitploit:~
php -l Classes/Domain/Repository/AbstractDemandedRepository.php
php -l Classes/Domain/Repository/NewsRepository.php

Load a normal news page and, where used, a Date Menu page. Do not test this fix by sending exploit payloads to a production website.

Important

news 8.6.0, TYPO3 9.5, and PHP 7.4 are end-of-life. This patch mitigates this specific vulnerability only; it is not a replacement for an upgrade or a full security review.

License and attribution

The patch is derived from the upstream georgringer/news security fix and is provided under the same GPL-2.0-or-later terms as that project. Please refer to the upstream project for the complete license and source history.

Download Tool