CVE-2026-46722

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.

CVSS

No CVSS.

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2026-011

Configurations

No configuration.

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El análisis OOXML del indexador de archivos no deshabilita la resolución de entidades externas. Un documento xlsx o pptx especialmente diseñado, colocado en un directorio indexado, puede provocar la lectura de archivos locales o que se realicen solicitudes HTTP salientes, con el contenido recuperado siendo escrito en el índice de búsqueda.

Information

Published : 2026-05-19 10:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-46722

Mitre link : CVE-2026-46722

CVE.ORG link : CVE-2026-46722

JSON object : View

Products Affected

No product.

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-46722", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46722", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T13:29:49.636642Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"repo": "https://github.com/tpwd/ke_search", "vendor": "TYPO3", "product": "Extension \"Faceted Search\"", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.1", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.6.1", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.6.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.6.7", "versionType": "semver"}], "packageName": "tpwd/ke_search", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T10:16:25.027", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-011", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index."}, {"lang": "es", "value": "El an\u00e1lisis OOXML del indexador de archivos no deshabilita la resoluci\u00f3n de entidades externas. Un documento xlsx o pptx especialmente dise\u00f1ado, colocado en un directorio indexado, puede provocar la lectura de archivos locales o que se realicen solicitudes HTTP salientes, con el contenido recuperado siendo escrito en el \u00edndice de b\u00fasqueda."}], "lastModified": "2026-10-26T13:10:00.140", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}