Medium severity · published May 19, 2026
CVE-2026-46722
XML External Entity Injection in extension "Faceted Search" (ke_search)
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Extension "Faceted Search" · TYPO3
7.0.0 before 7.0.1; 6.0.0 before 6.6.1; 5.0.0 before 5.6.2; before 4.6.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46722
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-011
More from Extension "Faceted Search"
5.9
CVE-2026-46724
Path Traversal in extension "Faceted Search" (ke_search)
5.9
CVE-2026-46723
Information Disclosure in extension "Faceted Search" (ke_search)