CVE-2026-46724
Path Traversal in extension "Faceted Search" (ke_search)
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Path Traversal in extension "Faceted Search" (ke_search)
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
- Record
CVE-2026-46724- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-30864
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
- Record
EUVD-2026-30864- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c72x-mc2p-wv7x
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
In TYPO3 faceted fulltext search (ke_search), the file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-c72x-mc2p-wv7x- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
- Record
CVE-2026-46724- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Path Traversal in extension "Faceted Search" (ke_search)
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
- Record
CVE-2026-46724- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-c72x-mc2p-wv7x
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
In TYPO3 faceted fulltext search (ke_search), the file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-c72x-mc2p-wv7x- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1 | 7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1 | 6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2 | 5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7 | 4.6.7 |
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1, plus listed versions v7.0.0 |
7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1, plus listed versions v6.0.0v6.0.1v6.1.0v6.1.1v6.1.2 Show 7 moreShow lessv6.1.3v6.2.0v6.3.0v6.4.0v6.4.1v6.5.0v6.6.0 |
6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2, plus listed versions v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4 Show 15 moreShow lessv5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.3.0v5.4.0v5.4.1v5.5.0v5.5.1v5.5.2v5.5.3v5.6.0v5.6.1 |
5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7, plus listed versions 1.99.01.99.21.99.41.99.51.99.7 Show 45 moreShow less2.0.02.0.12.0.22.0.32.0.42.1.02.2.02.2.14.0.2v2.3.0v2.3.1v2.4.0v2.4.1v2.4.2v2.5.0v2.6.0v2.6.1v2.6.2v2.6.3v2.7.0v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.1.0v3.1.1v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.2.0v3.3.0v3.3.1v3.4.0v3.4.1v3.4.2 |
4.6.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46724 is a medium vulnerability (CVSS 5.9) in Typo3 Extension "faceted Search", published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in tpwd/ke_search 7.0.1.
References
typo3.org/security/advisory/typo3-ext-sa-2026-011
nvd.nist.gov/vuln/detail/CVE-2026-46724
github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46724.yaml
packagist.org
Left out here: 31 versions. The JSON record has them.