The TYPO3 Extension "Faceted Search" suffers from an XML External Entity (XXE) vulnerability (CWE-611) due to improper restriction of external entity resolution in its OOXML file indexer. Specifically, when parsing xlsx or pptx documents, external entities are not disabled, enabling an attacker to craft malicious files that cause the system to read local files or perform outbound HTTP requests. The content obtained through these actions is then written into the search index, potentially exposing sensitive data or enabling further attacks. This vulnerability affects versions 5.0.0, 6.0.0, and 7.0.0 of the extension. The CVSS 4.0 base score is 5.9 (medium severity). No patch or official remediation level has been disclosed by the vendor as of the publication date.

An attacker with the ability to place crafted xlsx or pptx files in indexed directories can exploit this vulnerability to cause the TYPO3 Faceted Search extension to read local files or make outbound HTTP requests. The retrieved data is then written into the search index, which could lead to unauthorized disclosure of sensitive local files or data fetched from external sources. The vulnerability requires privileges to place files in indexed directories and does not involve user interaction. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write permissions to directories indexed by the Faceted Search extension to trusted users only and avoid placing untrusted OOXML files in these directories. Monitor vendor communications for updates on patches or official mitigations.