TYPO3-EXT-SA-2026-011: Multiple vulnerabilities in extension "Faceted Search" (ke_search)
It has been discovered that the extension "Faceted Search" (ke_search) is vulnerable to XML External Entity injection, Path Traversal and Information Disclosure.
- Release Date: May 19, 2026
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Faceted Search" (ke_search)
- Composer Package Name: tpwd/ke_search
- Vulnerability Type: XML External Entity injection, Path Traversal and Information Disclosure
- Affected Versions: 7.0.0, 6.0.0 - 6.6.0, 5.6.1 and below
- Severity: Medium
- Suggested CVSS v4.0: AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
- References: CVE-2026-46722, CVE-2026-46723, CVE-2026-46724, CWE-611, CWE-668, CWE-22
Problem Description
The OOXML parsing of the file indexer does not disable external entity resolution, making it susceptible to XML External Entity Injection. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Additionally, the additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names, allowing a backend user with permission to edit indexer configurations to copy sensitive data from internal TYPO3 tables into the search index. Similarly, the file indexer does not normalize the configured directories path, allowing such a user to index documents from arbitrary locations on the server file system through path traversal sequences.
Solution
Updated versions 7.0.1, 6.6.1 and 5.6.2 are available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/ke_search/7.0.1/zip
https://extensions.typo3.org/extension/download/ke_search/6.6.1/zip
https://extensions.typo3.org/extension/download/ke_search/5.6.2/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to Seungbin Yang for reporting the vulnerabilities and to Christian Bülter for providing updated versions of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.