This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in the TYPO3 Extension "Faceted Search." The file indexer component fails to normalize directory paths, enabling a backend user with edit permissions on indexer configurations to perform path traversal attacks. This allows indexing of files from arbitrary server locations, potentially exposing sensitive data. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, and high impact on confidentiality. No official fix or patch has been indicated by the vendor as of the published date.

An attacker with backend user permissions to edit indexer configurations can exploit this vulnerability to index and potentially access files outside the intended directory scope on the server. This could lead to unauthorized disclosure of sensitive information stored on the server file system. The impact is limited to users with specific backend permissions, reducing the overall risk to unauthorized external attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user permissions to only trusted administrators and avoid granting edit permissions on indexer configurations to untrusted users. Monitor TYPO3 vendor advisories for updates regarding patches or official mitigations.