Path Traversal in Typo3 Extension "Faceted Search"

CVE-2026-46724

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.001 (17.7th percentile) — read the EPSS interpretation.