TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)

• Release Date: October 20, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: “File manager” (ameos_filemanager)
• Composer Package Name: ameos/ameos_filemanager
• Vulnerability Type: SQL Injection
• Affected Versions: 3.1.2 and below
• Severity: High
• Suggested: CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• References: CVE-2026-112238, CWE-89

Problem Description

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

Solution

The updated version 3.1.3 is available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/ameos_filemanager/3.1.3/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Tobias Schäfer for reporting the vulnerability and to Raphael Geyer for providing an updated version of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.