CVE-2026-46724: TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
Other sources
TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (kesearch)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/tpwd/ke_searchto a version that resolves this vulnerability.Fixed in 7.0.1 - Upgrade
Upgrade
composer/tpwd/ke_searchto a version that resolves this vulnerability.Fixed in 6.6.1 - Upgrade
Upgrade
composer/tpwd/ke_searchto a version that resolves this vulnerability.Fixed in 5.6.2 - Upgrade
Upgrade
composer/tpwd/ke_searchto a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46724?
CVE-2026-46724 is considered a high severity vulnerability due to potential exploitation through path traversal.
How do I fix CVE-2026-46724?
To mitigate CVE-2026-46724, ensure that appropriate path normalization is implemented in the indexer configuration.
Who is affected by CVE-2026-46724?
The vulnerability affects users of the TYPO3 ke_search (Faceted Search) extension with permissions to edit indexer configurations.
What type of attack does CVE-2026-46724 enable?
CVE-2026-46724 enables path traversal attacks, allowing unauthorized access to arbitrary filesystem locations.
Is there a patch available for CVE-2026-46724?
Yes, a patch has been released by TYPO3 to address CVE-2026-46724, which users should apply immediately.