CVE-2026-8827
HighSummary
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation.
Risk Assessment
However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
Recommendation
It is recommended that administrators ensure no custom extensions invoke this method with untrusted input.
Original NVD description (English source)
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.