CVE-2026-46724

Vulnerability

Description The file indexer in the TYPO3 extension 'Faceted Search' (ke_search) does not normalize the configured directory path. This allows a backend user with permission to edit indexer configurations to include path traversal sequences such as ../ in the directory setting, causing the indexer to process files from arbitrary locations on the server file system [1].

Exploitation

An attacker must have backend user privileges that grant access to modify indexer configurations. By crafting a path with traversal sequences, the indexer will traverse outside the intended directory and index files from any path accessible to the web server process. No additional authentication is required beyond the backend user role.

Impact

Successful exploitation enables an attacker to index sensitive documents located outside the originally configured directory. This can lead to unauthorized disclosure of confidential files, such as configuration files, private data, or system files, depending on server file permissions.

Mitigation

The vulnerability has been patched in ke_search versions 7.0.1, 6.6.1, and 5.6.2. Users are advised to update to these versions as soon as possible [1].