CVE-2026-46722
XML External Entity Injection in extension "Faceted Search" (ke_search)
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XML External Entity Injection in extension "Faceted Search" (ke_search)
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
- Record
CVE-2026-46722- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-30859
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
- Record
EUVD-2026-30859- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fq39-62gx-8hqx
TYPO3 ke_search XML External Entity Injection
In TYPO3 faceted fulltext search (ke_search), the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-fq39-62gx-8hqx- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
- Record
CVE-2026-46722- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
XML External Entity Injection in extension "Faceted Search" (ke_search)
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
- Record
CVE-2026-46722- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-fq39-62gx-8hqx
TYPO3 ke_search XML External Entity Injection
In TYPO3 faceted fulltext search (ke_search), the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-fq39-62gx-8hqx- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1 | 7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1 | 6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2 | 5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7 | 4.6.7 |
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1, plus listed versions v7.0.0 |
7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1, plus listed versions v6.0.0v6.0.1v6.1.0v6.1.1v6.1.2 Show 7 moreShow lessv6.1.3v6.2.0v6.3.0v6.4.0v6.4.1v6.5.0v6.6.0 |
6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2, plus listed versions v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4 Show 15 moreShow lessv5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.3.0v5.4.0v5.4.1v5.5.0v5.5.1v5.5.2v5.5.3v5.6.0v5.6.1 |
5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7, plus listed versions 1.99.01.99.21.99.41.99.51.99.7 Show 45 moreShow less2.0.02.0.12.0.22.0.32.0.42.1.02.2.02.2.14.0.2v2.3.0v2.3.1v2.4.0v2.4.1v2.4.2v2.5.0v2.6.0v2.6.1v2.6.2v2.6.3v2.7.0v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.1.0v3.1.1v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.2.0v3.3.0v3.3.1v3.4.0v3.4.1v3.4.2 |
4.6.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46722 is a medium vulnerability (CVSS 5.9) in Typo3 Extension "faceted Search", published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in tpwd/ke_search 7.0.1.
References
typo3.org/security/advisory/typo3-ext-sa-2026-011
nvd.nist.gov/vuln/detail/CVE-2026-46722
github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46722.yaml
packagist.org
Left out here: 31 versions. The JSON record has them.