CVE-2026-56096: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it by submitting crafted search queries. No site-specific configuration is required for the described attack.
What access or conditions does an attacker need?
The attacker needs access to a search input that passes a user-supplied query parameter to Apache Solr. Exploitation relies on advanced Solr query syntax, including wildcards, field selectors, and range queries.
What information could be exposed?
An attacker may enumerate indexed field names and extract stored values from the Solr index. The described extraction uses boolean- and range-based blind techniques.