Description
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Faceted Search" | 7.0.0 – < 7.0.1, 6.0.0 – < 6.6.1, < 5.6.2 | 7.0.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | tpwd/ke_search | >= 7.0.0, < 7.0.1 | 7.0.1 | GHSA-67j3-jmm3-32xc |
| Packagist | tpwd/ke_search | >= 6.0.0, < 6.6.1 | 6.6.1 | GHSA-67j3-jmm3-32xc |
| Packagist | tpwd/ke_search | >= 5.0.0, < 5.6.2 | 5.6.2 | GHSA-67j3-jmm3-32xc |
| Packagist | tpwd/ke_search | < 4.6.7 | 4.6.7 | GHSA-67j3-jmm3-32xc |
Advisories 1
- WID-SEC-2026-1585 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 19, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-011 vendor-advisory