EUVD-2026-30864
GHSA-c72x-mc2p-wv7x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
AnalysisAI
Path traversal in the TYPO3 'Faceted Search' extension's file indexer exposes arbitrary server filesystem content to high-privileged backend users. Because the indexer does not normalize or canonicalize the configured directory path before use, a backend user holding the specific permission to edit indexer configurations can supply path traversal sequences to redirect indexing at sensitive locations outside the intended document root. The CVSS 4.0 score of 5.9 (Medium) reflects high confidentiality impact (VC:H) constrained by the requirement for high privileges (PR:H). No public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal weakness. TYPO3 is a PHP-based enterprise CMS; its 'Faceted Search' extension (CPE: cpe:2.3:a:typo3:extension_"faceted_search":*:*:*:*:*:*:*:*) provides a configurable file indexer that reads document directories and feeds their contents into a search index. The flaw arises because the extension accepts an administrator-supplied directory path and passes it to the indexer without first normalizing it - for example, resolving '..' sequences or anchoring to an allowed base path. As a result, sequences such as '../../etc/' or absolute paths can escape the intended directory boundary, causing the indexer to traverse and expose filesystem content the web application user account can read. The attack vector is Network (AV:N) because the configuration is submitted via TYPO3's web-based backend, though AT:P indicates additional prerequisites (the specific permission grant) must be in place.
RemediationAI
The primary fix is to update the TYPO3 'Faceted Search' extension to the patched version identified in the vendor advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-011. Patch available per vendor advisory; an exact fixed version number was not independently confirmed from the available input data and must be verified directly from that advisory. As a compensating control prior to patching, administrators should immediately audit and restrict the 'edit indexer configurations' backend permission, removing it from any role assigned to partially trusted users and retaining it only for fully trusted site administrators - this directly eliminates the PR:H attack vector for untrusted accounts. Additionally, enforcing PHP-level open_basedir restrictions or OS-level filesystem permissions that limit the web server process to only required document directories will reduce the blast radius of any path traversal attempt, though this may require testing to avoid disrupting legitimate indexer functionality.
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vul
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today