This vulnerability (CVE-2026-46722) in the TYPO3 Extension "Faceted Search" involves improper restriction of XML External Entity (XXE) references (CWE-611) during OOXML parsing by the file indexer. External entity resolution is not disabled, enabling an attacker to craft malicious xlsx or pptx documents that, when indexed, can cause the system to read local files or perform outbound HTTP requests. The content retrieved through these actions is then written into the search index, potentially exposing sensitive information or enabling further attacks. The vulnerability affects TYPO3 Faceted Search versions 0, 6.0.0, and 7.0.0. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, and partial privileges required.

An attacker with the ability to place crafted OOXML files in indexed directories can exploit this vulnerability to read local files on the server or cause outbound HTTP requests. The retrieved data is written into the search index, which may lead to unauthorized disclosure of sensitive information. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since there is no official fix or temporary workaround provided, users should monitor TYPO3 advisories for updates. Until a patch is available, avoid indexing untrusted OOXML files or restrict the ability to place such files in indexed directories.