CVE-2026-46724: Path Traversal in extension "Faceted Search" (ke_search)
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46724?
CVE-2026-46724 is considered a high severity vulnerability due to potential exploitation through path traversal.
How do I fix CVE-2026-46724?
To mitigate CVE-2026-46724, ensure that appropriate path normalization is implemented in the indexer configuration.
Who is affected by CVE-2026-46724?
The vulnerability affects users of the TYPO3 ke_search (Faceted Search) extension with permissions to edit indexer configurations.
What type of attack does CVE-2026-46724 enable?
CVE-2026-46724 enables path traversal attacks, allowing unauthorized access to arbitrary filesystem locations.
Is there a patch available for CVE-2026-46724?
Yes, a patch has been released by TYPO3 to address CVE-2026-46724, which users should apply immediately.