CVE-2026-46722: medium-severity vulnerability in TYPO3 Extension "Faceted Search"
XML External Entity Injection in extension "Faceted Search" (ke_search)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
TYPO3 · Extension "Faceted Search"Related CVEs — TYPO3 Extension "Faceted Search"
In the same product, most dangerous first.