Medium severity · published May 19, 2026
CVE-2026-46724
Path Traversal in extension "Faceted Search" (ke_search)
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Extension "Faceted Search" · TYPO3
7.0.0 before 7.0.1; 6.0.0 before 6.6.1; 5.0.0 before 5.6.2; before 4.6.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46724
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-011
More from Extension "Faceted Search"
5.9
CVE-2026-46723
Information Disclosure in extension "Faceted Search" (ke_search)
5.9
CVE-2026-46722
XML External Entity Injection in extension "Faceted Search" (ke_search)