--- title: "Releases 12.1" manual: "Apache Solr for TYPO3" version: "12.1" source: "Releases/solr-release-12-1.rst" modified: "2026-09-16T15:14:12+00:00" --- # Releases 12.1 > [!WARNING] > **Attention** > > You are on docs for EXT:solr release version. > This file may be outdated if you are on wrong release "branch" version. > To get the most recent changelog, please choose on the top left dropdown menu the version you are looking for. ## Release 12.1.5 Restores the highlighting teaser for non-matching results and fixes a frontend crash from an emptied filter section in the plugin FlexForm. ### !!! Last release for TYPO3 12 LTS This is the last planned release on this branch. EXT:solr no longer supports TYPO3 12 LTS after `12.1.5`. ### All Changes - \[BUGFIX\] Ignore an emptied filter section in the plugin FlexForm by @dkd-kaehm in [#4788](https://github.com/TYPO3-Solr/ext-solr/pull/4788) - \[BUGFIX\] Restore teaser for results without a match in the highlighted field by @dkd-kaehm in [#4778](https://github.com/TYPO3-Solr/ext-solr/pull/4778) - \[DOCS\] Update highlighting reference for the Unified Highlighter by @dkd-kaehm in [#4778](https://github.com/TYPO3-Solr/ext-solr/pull/4778) ## Release 12.1.4 This is a security release for TYPO3 12 LTS. ### !!! Recommendation: align existing Solr volumes with the new configset The `ext_solr_12_1_0` configset now sets the Unified Highlighter as default on both the `/select` and `/browse` request handlers. Solr volumes created from older configsets default to the legacy highlighter and remain vulnerable to the `FieldExistsQuery` HTTP 500 oracle when queried directly (bypassing EXT:solr). Run the bundled migration script against the existing configset to align the defaults; the script is idempotent and writes a `solrconfig.xml.Backup-SST-235567` backup next to the modified file: \* `Docker/SolrServer/docker-entrypoint-initdb.d-as-sudo/fix-SST-235567-2026050810000025-highlighter-defaults.sh` EXT:solr itself enforces the Unified Highlighter unconditionally in PHP, so this configset alignment is a defence-in-depth measure for clients that query Solr directly. ### !!! New: TypoScript settings for query-syntax handling Two new TypoScript settings govern how user input on `tx_solr[q]` is parsed: - `plugin.tx_solr.search.query.userFields` — whitelist of fields a Solr field-selector (`field:value`) may target. By default derived from `query.queryFields`; selectors against other fields are now treated as literal terms and silently miss. Sites that rely on selectors against non-`qf` fields must extend the whitelist via a scalar override or the `add` / `remove` sub-keys. - `plugin.tx_solr.search.query.allowSolrOperatorSyntax` — toggle for operator-syntax passthrough. Default `1` keeps the documented `+ - && || ! * ?` UX functional; set to `0` for strict mode (additionally escapes `| & ;`). Selector, range and grouping characters (`: [ ] ( ) { } ^ " ~ \ /`) are always escaped regardless. See [tx_solr.search](../Configuration/Reference/TxSolrSearch.html#configuration.reference.solrsearch) for full reference details. ### !!! Breaking: multi-value cObjs now use JSON transport The `SOLR_MULTIVALUE`, `SOLR_RELATION` and `SOLR_CLASSIFICATION` content objects now return their multi-value payload as `json_encode($array)` instead of `serialize($array)`, and the indexer decodes it with `json_decode()` instead of `unserialize()`. Because `json_decode()` never reconstructs PHP objects, the indexer can no longer be turned into a PHP object-injection sink by an attacker who can influence an indexed record field. Third-party content objects that returned `serialize($array)` for a multi-value Solr field must switch to `json_encode($array)`; no other change is required. ### !!! Security: additionalFilters can no longer preempt the siteHash filter Request-provided `tx_solr[additionalFilters]` could register a named `siteHash` filter that `AbstractQueryBuilder::useFilter()` refused to overwrite, so the system `siteHash` filter added later by `AccessComponent` was dropped. In a shared-Solr-core multi-site installation this let an anonymous visitor of one site read public documents of another site sharing the same core (CVE-2026-56094). EXT:solr now strips the reserved filter names `siteHash` and `access` from request-provided `additionalFilters` before they reach the query, and applies the system `siteHash` filter with remove-then-set semantics so request input can no longer preempt it. Filters that integrators set server-side — TypoScript `plugin.tx_solr.search.query.filter.`, plugin/FlexForm, or PSR-14 events — are unaffected. **Impact for integrators:** a frontend request can no longer override `siteHash` (or `access`) through `tx_solr[additionalFilters]`. Cross-site search must be configured server-side via `plugin.tx_solr.search.query.allowedSites` as documented in [tx_solr.search](../Configuration/Reference/TxSolrSearch.html#configuration.reference.solrsearch). ### !!! Security: detail view enforces site and access restrictions (CVE-2026-56093) The `detail` action of the `pi_results` plugin looked up a document by its `documentId` without applying the current site's `siteHash` filter or the frontend user-group access filter. An anonymous visitor who knew or guessed a valid `documentId` could therefore retrieve access-restricted documents through the detail view — a path that was less restricted than the regular search. The direct `documentId` lookup now applies the same `siteHash` and frontend user-group filters as the normal search path. A `documentId` that resolves to no accessible document — unknown, from another site, or restricted for the current visitor — yields the site's configured 404 page. The response is uniform, so it cannot be used to probe whether a restricted document exists. As defence in depth, review whether your templates still expose `data-document-id` and mask it where the document id should not be publicly visible. ### !!! Security: page indexer no longer forges access fields on page records (CVE-2026-56092) During a page-indexer sub-request, EXT:solr forced `fe_group` and `extendToSubpages` to public values on every `pages` record it touched, so the indexer itself would not be blocked by access restrictions. On TYPO3 12 that override was applied where TYPO3 Core discards it again, so it never reached the shared `rootline` cache and no access bypass resulted. On TYPO3 13 the same override was persisted, letting anonymous visitors reach pages restricted only by an ancestor page's `extendToSubpages`. The indexer no longer forges these fields. The access bypass it needed during indexing was already provided safely, without touching any persisted cache, by EXT:solr's other, unaffected listeners. #### All Changes - \[SECURITY\] Fix CVE-2026-56096 — close FVH FieldExistsQuery HTTP 500 oracle by @dkd-kaehm in [73c4a52af](https://github.com/TYPO3-Solr/ext-solr/commit/73c4a52afb9fcd341656d2a3af546413d6f081a1) - \[SECURITY\] Fix CVE-2026-56096 — edismax uf whitelist by @dkd-kaehm in [918c4c957](https://github.com/TYPO3-Solr/ext-solr/commit/918c4c957f3aa1a8c4d66a38fc7218a31bcb1477) - \[SECURITY\] Fix CVE-2026-56096 — escape user query syntax by @dkd-kaehm in [a63c3e586](https://github.com/TYPO3-Solr/ext-solr/commit/a63c3e586fbdb7885b50666a5101b1716e4d9d6f) - !!!\[SECURITY\] Fix CVE-2026-56095 — JSON transport for multi-value cObjs by @dkd-kaehm in [268bc8124](https://github.com/TYPO3-Solr/ext-solr/commit/268bc812417be83a536055109ab41df269f608c2) - \[SECURITY\] Fix CVE-2026-56094 — Prevent request additionalFilters from preempting siteHash filter by @dkd-kaehm in [925596ac2](https://github.com/TYPO3-Solr/ext-solr/commit/925596ac2e8d88cad86f5009eec7dd95345fbfe1) - \[SECURITY\] Fix CVE-2026-56093 — Enforce siteHash and access filters in detailAction lookup by @dkd-kaehm in [058af60ac](https://github.com/TYPO3-Solr/ext-solr/commit/058af60acd8a18588daff51954e8e67ca50a9943) - \[TASK\] Drop dead checkEnableFields() hook from UserGroupDetector by @dkd-kaehm in [17292d950](https://github.com/TYPO3-Solr/ext-solr/commit/17292d950086d30899d6f05fb6af2f5e511f31d6) - \[SECURITY\] Fix CVE-2026-56092 — Stop rootline cache poisoning via forged fe_group/extendToSubpages by @dkd-kaehm in [796e9a87f](https://github.com/TYPO3-Solr/ext-solr/commit/796e9a87f9f830f080419e24f952a087076953f0) ## Release 12.1.3 This is a maintenance release for TYPO3 12 LTS that removes the temporary `guzzlehttp/psr7 <2.10.0` pin introduced in 12.1.2, now that the upstream fix is available. > [!NOTE] > This is the **final regular release on the 12.1.x line before > the transition to EXT:solr ELTS 12** (if sufficiently funded). > Subsequent maintenance for TYPO3 12 LTS will be delivered through > the EXT:solr ELTS program. See [https://www.typo3-solr.com](https://www.typo3-solr.com) for > ELTS subscription details. #### All Changes - \[TASK\] Remove guzzlehttp/psr7 <2.10.0 pin (upstream fix in guzzlehttp/guzzle 7.10.2) by @dkd-kaehm in [#4660](https://github.com/TYPO3-Solr/ext-solr/issues/4660) ## Release 12.1.2 This is a bugfix release for TYPO3 12 LTS, primarily restoring Solr write functionality after a regression introduced by an upstream PSR-7 library update. #### All Changes - \[BUGFIX\] Pin guzzlehttp/psr7 to <2.10.0 by @dkd-kaehm in [#4663](https://github.com/TYPO3-Solr/ext-solr/pull/4663) - \[BUGFIX\] facet URL encoding mismatch (spaces) when using urlParameterStyle=assoc by @dkd-hauser in [#4625](https://github.com/TYPO3-Solr/ext-solr/pull/4625) - \[BUGFIX\] Correct field name casing for subTitle and navTitle in TypoScript queryFields by @amirarends in [#4623](https://github.com/TYPO3-Solr/ext-solr/pull/4623) - \[TASK\] Upgrade GitHub Actions to latest versions by @dkd-kaehm in [#4600](https://github.com/TYPO3-Solr/ext-solr/pull/4600) - \[BUGFIX\] Cast result offset to integer by @SaschaNoLe in [#4584](https://github.com/TYPO3-Solr/ext-solr/pull/4584) - \[TASK\] fix CS 2026.03.08 by @dkd-kaehm in [#4579](https://github.com/TYPO3-Solr/ext-solr/pull/4579) - \[BUGFIX\] pass a request with page id to Configuration manager by @WebsiteDeveloper in [#4579](https://github.com/TYPO3-Solr/ext-solr/pull/4579) - \[BUGFIX\] Add checks for flexParentDatabaseRow key in methods by @Myrmod in [#4579](https://github.com/TYPO3-Solr/ext-solr/pull/4579) ## Release 12.1.1 This is a security release for TYPO3 12 LTS. ### !!! Upgrade to Apache Solr 9.10.1 Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance! - CVE-2025-54988: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs - CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests - CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin #### All Changes - \[DOCS\] Update version matrix in main for current versions by @dkd-kaehm in [#4506](https://github.com/TYPO3-Solr/ext-solr/pull/4506) - \[SECURITY\] Update to Apache Solr 9.10.1 by @dkd-friedrich in [#4517](https://github.com/TYPO3-Solr/ext-solr/pull/4517) ## Release 12.1.0 We are happy to release EXT:solr 12.1.0. The focus of this release has been on AI integrations. #### New in this release ### Initial vector search In 12.1 and 13.1 a first step towards vector and AI support has been taken, focusing on enhancing search capabilities through vector search technology. This feature allows more sophisticated and semantically enriched search functionalities by utilizing vector representation of text data. The current vector integration is very initial and intended as a starting point. We encourage users to test this feature and provide feedback to help improve its further development. ##### Key Highlights 1. **Initial Vector Search Introduction:** - The EXT:solr version 12.1 and 13.1 introduces an initial vector search option as a new search variant. - Activating this feature automatically generates vectors during indexing and frontend search. - A connected large language model (LLM) is required for operation, though it is not directly related to EXT:solr. 1. **Handling and Limitations of Vector Search:** - Current implementation includes limitations, especially in error handling when required LLMs are not defined, leading to potential impairments in indexing or search. - Indexing without vector calculation results in documents not being found despite successful index status. - A missing or unavailable LLM during search attempts can lead to a `SolrInternalServerErrorException`, returning an HTTP status 500. 1. **Configuring a Large Language Model:** - To use vector search, a large language model must be connected to encode text into vectors. - Configuration details are available in the Apache Solr Reference Guide 9.9. - Models can be uploaded using a JSON file and cURL command. **Example configuration for the JSON file** ```json { "class": "dev.langchain4j.model.openai.OpenAiEmbeddingModel", "name": "llm", "params": { "baseUrl": "https://api.openai.com/v1", "apiKey": "apiKey-openAI", "modelName": "text-embedding-3-small", "timeout": 5, "logRequests": true, "logResponses": true, "maxRetries": 2 } } ``` - The number of dimensions for vectors defaults to 768 but can be adjusted via the `SOLR_VECTOR_DIMENSION` environment variable. ##### Future Developments - **Improved Error Handling:** Future versions plan to enhance error handling during vector indexing and search to increase robustness and reliability. - **Additional Query Types:** New query types such as vector sorting and vector re-ranking are planned, allowing for more advanced search result manipulation. - **Backend Module for LLM Management:** A backend module for managing large language models is anticipated, simplifying maintenance and configuration for developers. This introduction marks a significant advancement for TYPO3's search capabilities by integrating AI technologies, with ongoing improvements and features planned for future releases. For more detailed technical implementation and setup instructions, users should refer to the version 12.1 or 13.1 release notes and the associated documentation sections. ##### Technical insights As soon as vector search is enabled, EXT:solr will use the connected LLM to generate vectors during indexing and for each search in the frontend. During indexing vectors are generated based on field `vectorContent` which is by default filled with the contents of the `content` field. TypoScript indexing configurations can be used to customize the contents of the `vectorContent` field, e.g.: **How to define the contents of the vector field** ```typoscript plugin.tx_solr.index.queue.news.fields { vectorContent = SOLR_CONTENT vectorContent.cObject = COA vectorContent.cObject { 10 = TEXT 10 { field = name } 15 = TEXT 15 { field = bodytext } } } ``` During indexing vectors will be created and stored in field `vector`. > [!TIP] > `vector` and `vectorContent` are not `stored` and thus not included in the search results, but for debugging purposes, it may be helpful to set to `stored="true"` to verify the stored content. ### !!! Upgrade to Apache Solr 9.10.0+ This release requires Apache Solr at least v9.10.0. ### !!! Allow nested TypoScript on multiValue fields This breaking change allows nested TypoScript index configurations for multi-value/array fields like: **How to define the contents of the vector field** ```typoscript plugin.tx_solr.index.queue.pages.fields.someDoktypeSpecificCategory_stringM = CASE plugin.tx_solr.index.queue.pages.fields.someDoktypeSpecificCategory_stringM { key.field = doktype 80 = SOLR_RELATION 80 { localField = some_doktype_specific_sys_category multiValue = 1 } } ``` This feature removes the SerializedValueDetector hook without any replacements, due of [new TypoScript parser in Frontend on TYPO3 12](https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/12.0/Breaking-97816-NewTypoScriptParserInFrontend.html), which does not require any manual stdWrap by EXT:solr. Each custom cObect implementation returning the array/object as PHP serialized string will be used without registration or check. Note: Empty arrays/objects will not be written to the documents. Check if your system uses the SerializedValueDetector hook `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['solr']['detectSerializedValue']` remove it and check the desired fields are properly indexed. #### All Changes - \[FEATURE\] Add DenseVectorField in schemas by @dkd-kaehm in [#4440](https://github.com/TYPO3-Solr/ext-solr/pull/4440) - \[TASK\] Prepare release-12.1.x branch by @dkd-kaehm in [#4445](https://github.com/TYPO3-Solr/ext-solr/pull/4445) - \[TASK\] 12.1.x-dev Update solarium/solarium requirement from 6.3.7 to 6.4.1 by @dependabot\[bot\] in [#4434](https://github.com/TYPO3-Solr/ext-solr/pull/4434) - \[FEATURE\] Initial vector search by @dkd-friedrich in [#4447](https://github.com/TYPO3-Solr/ext-solr/pull/4447) - \[TASK\] 12.1.x-dev Bump solr from 9.9.0 to 9.10.0 in /Docker/SolrServer by @dependabot\[bot\] in [#4463](https://github.com/TYPO3-Solr/ext-solr/pull/4463) - Fix bug for phrase search with slops, bigram and trigram by Florian Rival in [#4472](https://github.com/TYPO3-Solr/ext-solr/pull/4472) - \[BUGFIX\] Pass TypoScript configuration to SolrWriteService by @dkd-friedrich in [#4475](https://github.com/TYPO3-Solr/ext-solr/pull/4475) - \[FEATURE\] Add dateRange field type in schema by @tillhoerner in [#4487](https://github.com/TYPO3-Solr/ext-solr/pull/4487) - \[BUGFIX\] Replace TSFE call for page type by Sebastian Klein in [#4488](https://github.com/TYPO3-Solr/ext-solr/pull/4488) - \[FEATURE\] Improve BeforeSearchFormIsShownEvent by Simon Schaufelberger in [#4486](https://github.com/TYPO3-Solr/ext-solr/pull/4486) - \[FEATURE\] Add HEALTHCHECK to Dockerfile by @dkd-kaehm in [#4489](https://github.com/TYPO3-Solr/ext-solr/pull/4489) - !!!\[FEATURE\] allow nested TypoScript on multiValue fields by @dkd-kaehm in [#4496](https://github.com/TYPO3-Solr/ext-solr/pull/4496) ## Contributors Like always this release would not have been possible without the help from our awesome community. Here are the contributors to this release. (patches, comments, bug reports, reviews, ... in alphabetical order) - [Markus Friedrich](https://github.com/dkd-friedrich) - [Rafael Kähm](https://github.com/dkd-kaehm) Also a big thank you to our partners who have already concluded one of our new development participation packages such as Apache Solr EB for TYPO3 12 LTS (Maintenance): - 3m5. Media GmbH - ACO Ahlmann SE & Co. KG - AmedickSommer Neue Medien GmbH - CDG 59 - chiliSCHARF GmbH - Columbus Interactive GmbH - cosmoblonde GmbH - CPS GmbH - Davitec GmbH - Deutsches Literaturarchiv Marbach - Die Medialen GmbH - Digitale Offensive GmbH - Eidg. Forschungsanstalt WSL - GAYA - Gernot Leitgab - grips IT GmbH - Gyldendal A/S - HSPV NRW - INOTEC Sicherheitstechnik GmbH - Intersim AG - Kassenzahnärztliche Vereinigung Bayerns (KZVB) - La Financière agricole du Québec - Landesinstitut für Schule und Medien Berlin-Brandenburg - Landeskriminalamt Thüringen - Lingner Consulting New Media GmbH - LST AG - medien.de mde GmbH - MEDIENHAUS der Evangelischen Kirche in Hessen und Nassau GmbH - mellowmessage GmbH - NEW.EGO GmbH - OST Ostschweizer Fachhochschule - Provitex GmbH Provitex GmbH - Randstad Digital - rms. relationship marketing solutions GmbH - Serviceplan Suisse AG - sgalinski Internet Services - Stratis - Studio 9 GmbH - SUNZINET GmbH - Webtech AG - Werbeagentur netzpepper - zimmer7 GmbH ## How to Get Involved There are many ways to get involved with Apache Solr for TYPO3: - Submit bug reports and feature requests on [GitHub](https://github.com/TYPO3-Solr/ext-solr) - Ask or help or answer questions in our [Slack channel](https://typo3.slack.com/messages/ext-solr/) - Provide patches through Pull Request or review and comment on existing [Pull Requests](https://github.com/TYPO3-Solr/ext-solr/pulls) - Go to [www.typo3-solr.com](https://www.typo3-solr.com) or call [dkd](http://www.dkd.de) to sponsor the ongoing development of Apache Solr for TYPO3 Support us by becoming an EB partner: [https://shop.dkd.de/Produkte/Apache-Solr-fuer-TYPO3/](https://shop.dkd.de/Produkte/Apache-Solr-fuer-TYPO3/) or call: +49 (0)69 - 2475218 0