GHSA-fq39-62gx-8hqx

Source

https://github.com/advisories/GHSA-fq39-62gx-8hqx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fq39-62gx-8hqx/GHSA-fq39-62gx-8hqx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fq39-62gx-8hqx

Aliases

CVE-2026-46722

Published

2026-05-19T12:31:39Z

Modified

2026-09-10T03:51:05Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

TYPO3 ke_search XML External Entity Injection

Details

In TYPO3 faceted fulltext search (ke_search), the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.

Database specific

{
    "cwe_ids":  [
        "CWE-611"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-29T17:32:26Z",
    "nvd_published_at":  "2026-05-19T10:16:25Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / tpwd/ke_search

Package

Name: tpwd/ke_search
Purl: pkg:composer/tpwd/ke_search

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.1

Affected versions

v7.*

v7.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fq39-62gx-8hqx/GHSA-fq39-62gx-8hqx.json"

Packagist / tpwd/ke_search

Package

Name: tpwd/ke_search
Purl: pkg:composer/tpwd/ke_search

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.6.1

Affected versions

v6.*

v6.0.0

v6.0.1

v6.1.0

v6.1.1

v6.1.2

v6.1.3

v6.2.0

v6.3.0

v6.4.0

v6.4.1

v6.5.0

v6.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fq39-62gx-8hqx/GHSA-fq39-62gx-8hqx.json"

Packagist / tpwd/ke_search

Package

Name: tpwd/ke_search
Purl: pkg:composer/tpwd/ke_search

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.6.2

Affected versions

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.2.0

v5.2.1

v5.3.0

v5.4.0

v5.4.1

v5.5.0

v5.5.1

v5.5.2

v5.5.3

v5.6.0

v5.6.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fq39-62gx-8hqx/GHSA-fq39-62gx-8hqx.json"

Packagist / tpwd/ke_search

Package

Name: tpwd/ke_search
Purl: pkg:composer/tpwd/ke_search

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.6.7

Affected versions

1.*

1.99.0

1.99.2

1.99.4

1.99.5

1.99.7

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.2.0

2.2.1

v2.*

v2.3.0

v2.3.1

v2.4.0

v2.4.1

v2.4.2

v2.5.0

v2.6.0

v2.6.1

v2.6.2

v2.6.3

v2.7.0

v2.8.0

v2.8.1

v2.8.2

v2.8.3

v2.8.4

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

v3.0.5

v3.0.6

v3.1.0

v3.1.1

v3.1.2

v3.1.3

v3.1.4

v3.1.5

v3.1.6

v3.2.0

v3.3.0

v3.3.1

v3.4.0

v3.4.1

v3.4.2

v3.5.0

v3.6.0

v3.6.1

v3.7.0

v3.7.1

v3.7.2

v3.8.0

v3.8.1

v3.9.0

v4.*

v4.0.0

v4.0.1

v4.0.3

v4.1.0

v4.2.0

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.4.4

v4.4.5

v4.5.0

v4.5.1

v4.6.0

v4.6.1

v4.6.2

v4.6.3

v4.6.4

v4.6.5

v4.6.6

4.*

4.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fq39-62gx-8hqx/GHSA-fq39-62gx-8hqx.json"