What’s Vulnerable › Vulnerabilities
CVE-2026-46722: XML External Entity Injection in extension "Faceted Search" (ke_search)
- Severity: medium (CVSS 5.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-19 · updated 2026-10-26
- Weakness: CWE-611
Description
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Affected products
- TYPO3 Extension "Faceted Search": from 7.0.0 before 7.0.1; from 6.0.0 before 6.6.1; from 5.0.0 before 5.6.2; before 4.6.7 — fixed in 4.6.7, 5.6.2, 6.6.1, 7.0.1
How to fix
Upgrade to a fixed version: TYPO3 Extension "Faceted Search" 4.6.7, 5.6.2, 6.6.1, 7.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-46722 or the next vulnerability affects your stack