Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the OoxmlConversion.php file, specifically within the readXlsx and readPptx methods of the Tpwd\KeSearch\Utility\OoxmlConversion class. These methods are responsible for parsing OOXML files (.xlsx and .pptx). The vulnerability is caused by the use of the loadXML function with the LIBXML_NOENT and LIBXML_XINCLUDE flags. These flags instruct the XML parser to substitute entities and include external entities, creating an XML External Entity (XXE) injection vulnerability. An attacker could craft a malicious .xlsx or .pptx file containing external entity definitions that point to local files on the server or internal network resources. When the ke_search file indexer processes this malicious file, the XML parser would resolve these entities, and the content would be included in the search index, exfiltrating sensitive information. The patch resolves this by removing the LIBXML_NOENT and LIBXML_XINCLUDE flags from the loadXML calls, thus disabling the processing of external entities.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tpwd/ke_search | composer | >= 7.0.0, < 7.0.1 | 7.0.1 |
| tpwd/ke_search | composer | >= 6.0.0, < 6.6.1 | 6.6.1 |
| tpwd/ke_search | composer | >= 5.0.0, < 5.6.2 | 5.6.2 |
| tpwd/ke_search | composer | < 4.6.7 | 4.6.7 |
