The TYPO3 extension Apache Solr for TYPO3 – Enterprise Search forwards user‑supplied search queries straight to an Apache Solr instance without filtering advanced query syntax. This allows a remote, unauthenticated attacker to inject wildcards, field selectors, and range queries that enumerate indexed field names and, using Boolean and range‑based blind extraction techniques, read stored values. The weakness falls under CWE-943 and results in the unintended disclosure of internal data such as field contents that should remain confidential.

TYPO3 users employing the Apache Solr for TYPO3 – Enterprise Search extension are vulnerable. No specific product versions were enumerated in the advisory, so any deployment that includes this extension may be affected until a fix is applied.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The exploit requires only a remote HTTP request to the Solr search endpoint and does not need authentication or privileged access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker could use publicly available client tools or craft custom requests to trigger the information‑disclosure logic; once the query syntax is exploited, the amount of data that can be extracted depends on the Solr schema and the fields exposed, making this a potentially valuable target.