PT-2026-41862 · Unknown · Ps Facetedsearch

Christian Bülter + 1 · CVE-2026-46722 · Published 2026-05-19 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Faceted Search (ke search) (affected versions not specified)

Description The OOXML parsing of the file indexer fails to disable external entity resolution. This allows an attacker to use a specially crafted xlsx or pptx document placed in an indexed directory to trigger XML External Entity (XXE) injection—a process where an application processes external entities within an XML document. This can result in the reading of local files or the execution of outbound HTTP requests, with the retrieved data being written to the search index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-46722

GHSA-FQ39-62GX-8HQX

Affected Products

Ps Facetedsearch

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46722.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46722.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46722 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2026-011 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fq39-62gx-8hqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46722 · Vendor Advisory
• https://github.com/tpwd/ke_search · Note
• https://packagist.org · Note
• https://t.me/CVEtracker/54227 · Telegram Post