The file search feature of the TYPO3 File manager extension builds SQL query fragments by inserting the user‑supplied search term directly into a quoted string, escaping only the LIKE wildcard characters. A crafted search term that includes a quote character can break out of the intended string literal and inject additional SQL, enabling an attacker to read arbitrary data from the database. This is an instance of SQL injection (CWE‑89).

The vulnerability affects all installations of the TYPO3 "File manager" extension where the flaw is present. The CVE does not specify a particular version range, so any instance that has not been updated to a patched release is potentially vulnerable.

The CVSS score of 8.7 marks this as a high‑severity flaw. The EPSS score of less than 1% indicates that, although the vulnerability exists, exploitation is currently considered unlikely. The flaw is not listed in the CISA KEV catalog. It is likely that an attacker can exploit it remotely via the web interface that provides the file search functionality; a local user with access to the same interface could likewise craft a malicious search term.