The vulnerability resides in the TYPO3 extension “Faceted Search” (ke_search). When a backend user edits indexer configurations, the extension fails to normalize directory paths, allowing the user to include path traversal characters. This omission lets the attacker reference and index files from arbitrary locations on the server, effectively granting read access to sensitive files. The weakness is consistent with CWE‑22, which denotes path traversal deficiencies that can compromise confidentiality and integrity of system resources.

The affected product is the TYPO3 extension "Faceted Search" (ke_search). No specific affected versions are listed by the CNA, so all released copies of the extension could be vulnerable until a patch is applied.

The CVSS score of 5.9 places this flaw in the medium severity range, and the EPSS score is not reported, so the probability of exploitation in the wild cannot be quantified. It is not present in the CISA KEV catalog. The likely attack vector requires a legitimate backend session with permission to edit indexer configurations; attackers without such access would need to compromise a user account first. Once the attacker obtains the necessary permissions, they can read any file path that the web server process can access, potentially exposing sensitive configuration files or credentials.