
Minimal security backport for CVE-2026-8726 in georgringer/news 8.6.0
georgringer/news 8.6.0This repository contains a minimal backport for CVE-2026-8726 / TYPO3-EXT-SA-2026-010, a high-severity SQL injection vulnerability in the TYPO3 extension georgringer/news.
It is intended only for installations that must temporarily remain on news 8.6.0. The supported fix is to upgrade the extension to a maintained version. This patch is based on the upstream security changes released in news 10.0.4.
The TYPO3 advisory lists all news versions through 10.0.3 as affected. The attack path involves user-controlled demand parameters used with the Date Menu plugin. No authentication is required.
The patch changes only two repository classes:
It deliberately does not include unrelated changes from the upstream release.
Run the commands from the root of your news extension, not the TYPO3 project root. Create a backup first and test the patch before applying it.
cd typo3conf/ext/news
backup_dir=".security-backups/cve-2026-8726-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$backup_dir"
cp Classes/Domain/Repository/AbstractDemandedRepository.php \
Classes/Domain/Repository/NewsRepository.php "$backup_dir"/
patch --dry-run -p1 < /path/to/news-8.6.0-cve-2026-8726.patch
patch -p1 < /path/to/news-8.6.0-cve-2026-8726.patch
Then clear TYPO3's caches. For old non-Composer TYPO3 installations this can be done by removing the contents of typo3temp/var/cache/; use the TYPO3 CLI if it is available in your installation.
php -l Classes/Domain/Repository/AbstractDemandedRepository.php
php -l Classes/Domain/Repository/NewsRepository.php
Load a normal news page and, where used, a Date Menu page. Do not test this fix by sending exploit payloads to a production website.
news 8.6.0, TYPO3 9.5, and PHP 7.4 are end-of-life. This patch mitigates this specific vulnerability only; it is not a replacement for an upgrade or a full security review.
The patch is derived from the upstream georgringer/news security fix and is provided under the same GPL-2.0-or-later terms as that project. Please refer to the upstream project for the complete license and source history.