CVE-2026-46724 — Path Traversal in extension "Faceted Search" (ke_search)

CVE-2026-46724

Path Traversal in extension "Faceted Search" (ke_search) PUBLISHED

Description (CNA)

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "Faceted Search"	affected 7.0.0 before 7.0.1; affected 6.0.0 before 6.6.1; affected 5.0.0 before 5.6.2; affected 0 before 4.6.7

CWE

CWE-22

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-011

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.