GitHub Advisoryadvisory · Packagist

GHSA-fq39-62gx-8hqx TYPO3 ke_search XML External Entity Injection

MEDIUM Published 2026-05-19 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-46722
Ecosystem
Packagist
Packages
tpwd/ke_search
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-611
Reviewed
2026-06-29

Affected packages

• Packagist tpwd/ke_search: >= 7.0.0, < 7.0.1 → fixed in 7.0.1 • Packagist tpwd/ke_search: >= 6.0.0, < 6.6.1 → fixed in 6.6.1 • Packagist tpwd/ke_search: >= 5.0.0, < 5.6.2 → fixed in 5.6.2 • Packagist tpwd/ke_search: < 4.6.7 → fixed in 4.6.7

Description

In TYPO3 faceted fulltext search (`ke_search`), the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.

Related

Alias · CVE (1)

  • CVE-2026-46722 The OOXML parsing of the file indexer does not disable external entity resolution. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References