CVE-2026-46722CWE-611

XML External Entity Injection in extension "Faceted Search" (ke_search)

Medium · published May 19, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-05-19T09:23Z
EPSS history
Timeline
  • 19 MAY 09:23Z
    XML External Entity Injection in extension "Faceted Search" (ke_search)
    cvelistv5