Releases 11.6 

!!! All earlier 11.6.x releases stay vulnerable and will not be re-published 

11.6.6 is the only release of this branch that is published publicly. Releases 11.6.0 to 11.6.5 are affected by the CVEs fixed in this release and will not be re-published with a fix, so there is no patched 11.6.5 or earlier to move to — upgrade to 11.6.6.

!!! Solarium raised to 6.2.4 

solarium/solarium is raised from 6.2.3 to 6.2.4. This branch needs it to enforce the fix in PHP at all: 6.2.3 ships no HighlightingInterface, no setOffsetSource() and no setFragsizeIsMinimum(), and its request builder emits h1.method instead of hl.method, so the Unified Highlighter never reached Solr. Composer resolves this on update; installations that pin solarium/solarium themselves must allow 6.2.4.

!!! Recommendation: align existing Solr volumes with the new configset 

The ext_solr_11_6_0_elts configset now sets the Unified Highlighter as default on both the /select and /browse request handlers. Solr volumes created from older configsets default to the legacy highlighter and remain vulnerable to the FieldExistsQuery HTTP 500 oracle when queried directly (bypassing EXT:solr). Run the bundled migration script against the existing configset to align the defaults; the script is idempotent and writes a solrconfig.xml.Backup-SST-235567 backup next to the modified file:

• Docker/SolrServer/docker-entrypoint-initdb.d-as-sudo/fix-SST-235567-2026050810000025-highlighter-defaults.sh

EXT:solr itself enforces the Unified Highlighter unconditionally in PHP, so this configset alignment is a defence-in-depth measure for clients that query Solr directly.

!!! New: TypoScript settings for query-syntax handling 

Two new TypoScript settings govern how user input on tx_solr[q] is parsed:

• plugin.tx_solr.search.query.userFields — whitelist of fields a Solr field-selector (field:value) may target. By default derived from query.queryFields; selectors against other fields are now treated as literal terms and silently miss. Sites that rely on selectors against non-qf fields must extend the whitelist via a scalar override or the add / remove sub-keys.
• plugin.tx_solr.search.query.allowSolrOperatorSyntax — toggle for operator-syntax passthrough. Default 1 keeps the documented + - && || ! * ? UX functional; set to 0 for strict mode (additionally escapes | & ;). Selector, range and grouping characters (: [ ] ( ) { } ^ " ~ \ /) are always escaped regardless.

See tx_solr.search for full reference details.

!!! Breaking: multi-value cObjs now use JSON transport 

The SOLR_MULTIVALUE, SOLR_RELATION and SOLR_CLASSIFICATION content objects now return their multi-value payload as json_encode($array) instead of serialize($array), and the indexer decodes it with json_decode() instead of unserialize(). Because json_decode() never reconstructs PHP objects, the indexer can no longer be turned into a PHP object-injection sink by an attacker who can influence an indexed record field.

Third-party content objects that returned serialize($array) for a multi-value Solr field must switch to json_encode($array); no other change is required. The same applies to extensions registering a SerializedValueDetector through $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['solr']['detectSerializedValue']: the flagged field is now JSON-decoded, so its content object must emit JSON as well.

!!! Security: additionalFilters can no longer preempt the siteHash filter 

Request-provided tx_solr[additionalFilters] could register a named siteHash filter that AbstractQueryBuilder::useFilter() refused to overwrite, so the system siteHash filter added later by AccessComponent was dropped. In a shared-Solr-core multi-site installation this let an anonymous visitor of one site read public documents of another site sharing the same core (CVE-2026-56094).

EXT:solr now strips the reserved filter names siteHash and access from request-provided additionalFilters before they reach the query, and applies the system siteHash filter with remove-then-set semantics so request input can no longer preempt it. Filters that integrators set server-side — TypoScript plugin.tx_solr.search.query.filter., plugin/FlexForm, or PSR-14 events — are unaffected.

Impact for integrators: a frontend request can no longer override siteHash (or access) through tx_solr[additionalFilters]. Cross-site search must be configured server-side via plugin.tx_solr.search.query.allowedSites as documented in tx_solr.search.

!!! Security: detail view enforces site and access restrictions (CVE-2026-56093) 

The detail action of the pi_results plugin looked up a document by its documentId without applying the current site's siteHash filter or the frontend user-group access filter. An anonymous visitor who knew or guessed a valid documentId could therefore retrieve access-restricted documents through the detail view — a path that was less restricted than the regular search.

The direct documentId lookup now applies the same siteHash and frontend user-group filters as the normal search path. A documentId that resolves to no accessible document — unknown, from another site, or restricted for the current visitor — yields the site's configured 404 page. The response is uniform, so it cannot be used to probe whether a restricted document exists.

As defence in depth, review whether your templates still expose data-document-id and mask it where the document id should not be publicly visible.

!!! Security: page indexer no longer forges access fields on page records (CVE-2026-56092) 

During a page-indexer sub-request, EXT:solr forced fe_group and extendToSubpages to public values on every pages record it touched, so the indexer itself would not be blocked by access restrictions.

On TYPO3 11 those forged values were written into the shared rootline cache. No anonymous-access bypass could be reproduced on this branch: the override only applies while a translated view is being resolved, whereas a visitor of an untranslated page is served — and cached — from the original record, and where a translation does exist the language overlay replaces the forged fields with the translated page's own values. The corrupted entries are wrong regardless, and a manually corrupted entry is honoured by the frontend access check, so this is fixed rather than tolerated. On TYPO3 13 the same override reached the entries visitors do read, which is where the reported disclosure occurred.

The indexer no longer forges these fields. The access bypass it needs during indexing was already provided safely, without touching any persisted cache, by EXT:solr's other, unaffected mechanisms.

Flush the rootline cache after updating. Entries written by earlier 11.6.x releases keep the forged values until they are rebuilt.

All Changes 

• [DOCS] Fix 11.6 docs metadata, archive Releases 11.2, align index directives by @dkd-kaehm in 294833d7a
• [SECURITY] Fix CVE-2026-56096 — close FVH FieldExistsQuery HTTP 500 oracle by @dkd-kaehm in 2ca0e8b47
• [SECURITY] Fix CVE-2026-56096 — edismax uf whitelist by @dkd-kaehm in fc0381c96
• [SECURITY] Fix CVE-2026-56096 — escape user query syntax by @dkd-kaehm in 9cc887eb4
• !!![SECURITY] Fix CVE-2026-56095 — JSON transport for multi-value cObjs by @dkd-kaehm in 6fd773ed7
• [TASK] fix Github Actions warnings by @dkd-kaehm in b663d4ff8
• [SECURITY] Fix CVE-2026-56094 — Prevent request additionalFilters from preempting siteHash filter by @dkd-kaehm in 114b4a90f
• [SECURITY] Fix CVE-2026-56093 — Enforce siteHash and access filters in detailAction lookup by @dkd-kaehm in a30973356
• [SECURITY] Fix CVE-2026-56092 — Stop rootline cache poisoning via forged fe_group/extendToSubpages by @dkd-kaehm in 40ab4e9b8
• [BUGFIX] Check rootline for feGroups from page with extendToSubpages set by Tim Horstmann in 33698d117
• [BUGFIX] Log TSFE initialization failures instead of swallowing them by @kitzberger in e0658a644
• [BUGFIX] Fallback for failed TSFE initialization when determining isAllowedPageType() by @kitzberger in fd8fd96a5

!!! Upgrade to Apache Solr 9.10.1 

Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance!

• CVE-2025-54988: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs
• CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests
• CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

New in this release 

!!![SECURITY] Update to Apache solr 9.8.0 : CVE-2025-24814 

Updates EXT:solr to Apache Solr 9.8.0.

Apache Solr 9.8.0 disables the possibility to load the jar files with lib directive by default, which was used to load jar files within the EXT:solr configsets. Apache Solr 10.0.0 will drop that functionality. All Apache Solr libs, modules or plugins must be configured within the main server configuration files. See: https://issues.apache.org/jira/browse/SOLR-16781

SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true"

!!![FIX] Docker execution order issue for as-sudo tweaks 

This change renames the file

• from /docker-entrypoint-initdb.d/as-sudo-tweaks.sh
• to /docker-entrypoint-initdb.d/0_as-sudo-tweaks.sh

and moves the folder

• from /docker-entrypoint-initdb.d/as-sudo/
• to /docker-entrypoint-initdb.d-as-sudo/

to fix the execution order issue when setting the correct file permissions when starting the docker container, leading to a Operation not permitted errors.

More details see:

• https://github.com/TYPO3-Solr/ext-solr/issues/3837#issuecomment-2461668377.
• https://github.com/TYPO3-Solr/ext-solr/pull/4219#issuecomment-2622600937

Minor changes & bugfixes 

• [DOCS] Improve Solr core creation via API and other deployment parts by @dkd-kaehm & @dkd-friedrich in #41
• [TASK] Use relative path to typo3lib in Apache Solr config by @dkd-kaehm & @dkd-friedrich in #41
• [BUGFIX] Docker twaks as-sudo do not preserve the Docker image ENV by @dkd-kaehm & @dkd-friedrich in #41
• [BUGFIX] Docker tests suite does not contain all logs by @dkd-kaehm & @dkd-friedrich in #41
• [BUGFIX] docker image tests do not fail if core can not start by @dkd-kaehm & @dkd-friedrich in #41
• [TASK] Replace "Publish to TER" to release by @dkd-kaehm in #38

Full list of changes 

• [TASK] Integrate TYPO3 11.5 ELTS by @dkd-kaehm & @dkd-friedrich
• [TASK] Prepare release-11.6.x ELTS by @dkd-friedrich
• [BUGFIX] NPE in Index Queue module when no site is selected by @adamkoppede
• [FEATURE] Add timeframe filter to statistics module by @BastiLu

New in this release