CVE-2026-46724

Description

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.

References

• https://typo3.org/security/advisory/typo3-ext-sa-2026-011