Security readout for executives and security teams
Plain-English summary
A flaw in the TYPO3 "Faceted Search" (ke_search) extension lets an attacker who can drop a booby-trapped Office document into an indexed folder cause the site's file indexer to read local files or make outbound web requests, then store that data in the search index. Impact is mainly information disclosure, and exploitation requires elevated permissions to place files.
Executive priority
Patch on the next scheduled maintenance window. Risk is limited by the requirement for a privileged actor to plant a malicious document, but successful abuse can leak server-side files and route requests outbound, warranting timely remediation on any TYPO3 site using ke_search.
Technical view
The OOXML parser used by ke_search's file indexer processes xlsx and pptx documents without disabling external entity resolution, resulting in an XXE (CWE-611). A crafted OOXML file placed in an indexed directory triggers entity resolution during indexing, allowing local file reads or SSRF-style outbound HTTP calls, with retrieved content persisted into the search index. CVSS 4.0 base is 5.9 with high privileges required and passive user interaction.
Likely exposure
TYPO3 sites running the tpwd/ke_search extension at versions before the fixed releases (advisory covers 0.x, 5.x, 6.x, and 7.x branches up to the noted fixed versions) where the file indexer is enabled against directories that authenticated users or integrators can populate with Office documents.
Exploitation context
No public exploitation reported and the CVE is not in CISA KEV. The CVSS vector requires high privileges (PR:H) and passive user interaction (AT:P), so exploitation depends on an actor already able to upload or place OOXML files into an indexed path. Confidentiality impact is high (local file disclosure), integrity and availability impact is none.
Researcher notes
Classic XXE via OOXML: attackers typically place external DTD or entity references inside the XML parts of an xlsx/pptx archive. Because the indexer writes retrieved data back into the search index, disclosed content may be observable via normal search queries, which is a useful validation signal. Confirm which XML parser and settings were changed in the fix commit to ensure other OOXML consumers in the codebase are not similarly exposed.
Mitigation direction
- Upgrade tpwd/ke_search to the fixed version listed in TYPO3-EXT-SA-2026-011.
- If patching is delayed, disable the file indexer or exclude OOXML file types from indexing.
- Restrict write access to indexed directories to trusted, minimum-privilege accounts.
- Review vendor advisory for any recommended configuration hardening after upgrade.
Validation and detection
- Inventory TYPO3 sites and query composer.lock or Extension Manager for tpwd/ke_search version.
- Confirm installed version against the fixed release named in TYPO3-EXT-SA-2026-011.
- Check ke_search configuration for enabled file indexers and the directories they scan.
- Audit indexed directories and search index contents for unexpected file paths or outbound URLs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-46722 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N——TYPO3Vulnerability scoring details
Base CVSS 4.0 score
5.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://typo3.org/security/advisory/typo3-ext-sa-2026-011CVE reference, TYPO3 · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.