XXE in Typo3 Extension "Faceted Search"

CVE-2026-46722

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieve…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.001 (17.1th percentile) — read the EPSS interpretation.