p PatchFirst

CVE-2026-46722

CVE-2026-46722 · XML External Entity Injection in extension "Faceted Search" (ke_search)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.

CVSS 5.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • extension "faceted search"

    Versions
    • ≥ 7.0.0, < 7.0.1: Affected (semver)
    • ≥ 6.0.0, < 6.6.1: Affected (semver)
    • ≥ 5.0.0, < 5.6.2: Affected (semver)
    • ≥ 0, < 4.6.7: Affected (semver)

    Update to 4.6.7; Update to 5.6.2; Update to 6.6.1; Update to 7.0.1

  • tpwd/ke_search Packagist

    Versions
    • v7.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.0.1

    Update to 7.0.1

  • tpwd/ke_search Packagist

    Versions
    • v6.0.0
    • v6.0.1
    • v6.1.0
    • v6.1.1
    • v6.1.2
    • v6.1.3
    • v6.2.0
    • v6.3.0
    • v6.4.0
    • v6.4.1
    • v6.5.0
    • v6.6.0
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0, < 6.6.1

    Update to 6.6.1

  • tpwd/ke_search Packagist

    Versions
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.0.3
    • v5.0.4
    • v5.1.0
    • v5.1.1
    • v5.1.2
    • v5.1.3
    • v5.2.0
    • v5.2.1
    • v5.3.0
    • v5.4.0
    • v5.4.1
    • v5.5.0
    • v5.5.1
    • v5.5.2
    • v5.5.3
    • v5.6.0
    • v5.6.1
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.6.2

    Update to 5.6.2

  • tpwd/ke_search Packagist

    Versions
    • 1.99.0
    • 1.99.2
    • 1.99.4
    • 1.99.5
    • 1.99.7
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 4.0.2
    • v2.3.0
    • v2.3.1
    • v2.4.0
    • v2.4.1
    • v2.4.2
    • v2.5.0
    • v2.6.0
    • v2.6.1
    • v2.6.2
    • v2.6.3
    • v2.7.0
    • v2.8.0
    • v2.8.1
    • v2.8.2
    • v2.8.3
    • v2.8.4
    • v3.0.0
    • v3.0.1
    • v3.0.2
    • v3.0.3
    • v3.0.4
    • v3.0.5
    • v3.0.6
    • v3.1.0
    • v3.1.1
    • v3.1.2
    • v3.1.3
    • v3.1.4
    • v3.1.5
    • v3.1.6
    • v3.2.0
    • v3.3.0
    • v3.3.1
    • v3.4.0
    • v3.4.1
    • v3.4.2
    • v3.5.0
    • v3.6.0
    • v3.6.1
    • v3.7.0
    • v3.7.1
    • v3.7.2
    • v3.8.0
    • v3.8.1
    • v3.9.0
    • v4.0.0
    • v4.0.1
    • v4.0.3
    • v4.1.0
    • v4.2.0
    • v4.3.0
    • v4.3.1
    • v4.4.0
    • v4.4.1
    • v4.4.2
    • v4.4.3
    • v4.4.4
    • v4.4.5
    • v4.5.0
    • v4.5.1
    • v4.6.0
    • v4.6.1
    • v4.6.2
    • v4.6.3
    • v4.6.4
    • v4.6.5
    • v4.6.6
    Affected ranges
    • ECOSYSTEM: < 4.6.7

    Update to 4.6.7

Original sources

Check your server →