CVE-2026-46722
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Risk Assessment
An attacker can exploit XXE to read local files or exfiltrate data via HTTP requests and then expose it in the search index. This poses a risk to data confidentiality and may aid network reconnaissance.
Recommendation
Disable external entity resolution in the file indexer's OOXML parser. Review search index contents for unexpected data.
Other vulnerabilities in TYPO3
See all- CVE-2026-113459High
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
- CVE-2026-46723Medium
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
- CVE-2023-38499Low
TYPO3 is a PHP-based content management system that had a vulnerability in versions from 9.4.0 to 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, allowing out-of-scope access to content in multi-site scenarios. This enabled visitors to access internal site content by manipulating HTTP query parameters in the URL.
Original NVD description (English source)
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS