15 matches found
XML External Entity (XXE) Injection
Overview tpwd/kesearch is a search extension for TYPO3, including faceting search functions. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the additionaltables configuration of the page and ttcontent indexers that accept arbitrary table and field names....
GHSA-FQ39-62GX-8HQX TYPO3 ke_search XML External Entity Injection
In TYPO3 faceted fulltext search kesearch, the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being...
GHSA-C72X-MC2P-WV7X TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
In TYPO3 faceted fulltext search kesearch, the file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. This has been patche...
TYPO3 ke_search XML External Entity Injection
In TYPO3 faceted fulltext search kesearch, the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being...
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
In TYPO3 faceted fulltext search kesearch, the file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. This has been patche...
CVE-2026-46724
CVE-2026-46724 affects the Typo3 extension Faceted Search (ke_search). The file indexer does not normalize the configured directory path, allowing a backend user with permission to edit indexer configurations to index documents from arbitrary server file-system locations via path traversal. CVSS ...
CVE-2026-46723 Information Disclosure in extension "Faceted Search" (ke_search)
The additionaltables configuration of the page and ttcontent indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index...
TYPO3-EXT-SA-2026-011: XML External Entity Injection in extension "Faceted Search" (ke_search)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...
TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...
CVE-2023-35783
The kesearch aka Faceted Search extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data...
TYPO3 cross-site scripting vulnerabilities
TYPO3 is a free and open source content management system framework CMS/CMF from TYPO3 Association in Switzerland. A cross-site scripting vulnerability exists in TYPO3 versions 4.0.2 and earlier, 4.1.0 through 4.6.5, and 5.0.0 through 5.0.1, which stems from the kesearch extension that allows...
CVE-2020-15517
The kesearch aka Faceted Search extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS...
PT-2020-14474
Name of the Vulnerable Software and Affected Versions ke search extension versions 2.8.2 and earlier ke search extension versions 3.x through 3.1.3 Description The issue allows for XSS. Recommendations For ke search extension versions 2.8.2 and earlier, update to a version later than 2.8.2. For k...
PT-2013-5467
Name of the Vulnerable Software and Affected Versions TYPO3 ke search extension versions prior to 1.4.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 1.4.1, update to version 1.4.1 or...
PT-2013-5462
Name of the Vulnerable Software and Affected Versions TYPO3 ke search extension versions prior to 1.4.1 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue...