Releases 13.1 

!!! Recommendation: align existing Solr volumes with the new configset 

The ext_solr_13_1_0 configset now sets the Unified Highlighter as default on both the /select and /browse request handlers. Solr volumes created from older configsets default to the legacy highlighter and remain vulnerable to the FieldExistsQuery HTTP 500 oracle when queried directly (bypassing EXT:solr). Run the bundled migration script against the existing configset to align the defaults; the script is idempotent and writes a solrconfig.xml.Backup-SST-235567 backup next to the modified file:

• Docker/SolrServer/docker-entrypoint-initdb.d-as-sudo/fix-SST-235567-2026050810000025-highlighter-defaults.sh

EXT:solr itself enforces the Unified Highlighter unconditionally in PHP, so this configset alignment is a defence-in-depth measure for clients that query Solr directly.

!!! New: TypoScript settings for query-syntax handling 

Two new TypoScript settings govern how user input on tx_solr[q] is parsed:

• plugin.tx_solr.search.query.userFields — whitelist of fields a Solr field-selector (field:value) may target. By default derived from query.queryFields; selectors against other fields are now treated as literal terms and silently miss. Sites that rely on selectors against non-qf fields must extend the whitelist via a scalar override or the add / remove sub-keys.
• plugin.tx_solr.search.query.allowSolrOperatorSyntax — toggle for operator-syntax passthrough. Default 1 keeps the documented + - && || ! * ? UX functional; set to 0 for strict mode (additionally escapes | & ;). Selector, range and grouping characters (: [ ] ( ) { } ^ " ~ \ /) are always escaped regardless.

See tx_solr.search for full reference details.

!!! Breaking: multi-value cObjs now use JSON transport 

The SOLR_MULTIVALUE, SOLR_RELATION and SOLR_CLASSIFICATION content objects now return their multi-value payload as json_encode($array) instead of serialize($array), and the indexer decodes it with json_decode() instead of unserialize(). Because json_decode() never reconstructs PHP objects, the indexer can no longer be turned into a PHP object-injection sink by an attacker who can influence an indexed record field.

Third-party content objects that returned serialize($array) for a multi-value Solr field must switch to json_encode($array); no other change is required.

!!! Security: additionalFilters can no longer preempt the siteHash filter 

Request-provided tx_solr[additionalFilters] could register a named siteHash filter that AbstractQueryBuilder::useFilter() refused to overwrite, so the system siteHash filter added later by AccessComponent was dropped. In a shared-Solr-core multi-site installation this let an anonymous visitor of one site read public documents of another site sharing the same core (CVE-2026-56094).

EXT:solr now strips the reserved filter names siteHash and access from request-provided additionalFilters before they reach the query, and applies the system siteHash filter with remove-then-set semantics so request input can no longer preempt it. Filters that integrators set server-side — TypoScript plugin.tx_solr.search.query.filter., plugin/FlexForm, or PSR-14 events — are unaffected.

Impact for integrators: a frontend request can no longer override siteHash (or access) through tx_solr[additionalFilters]. Cross-site search must be configured server-side via plugin.tx_solr.search.query.allowedSites as documented in tx_solr.search.

!!! Security: detail view enforces site and access restrictions (CVE-2026-56093) 

The detail action of the pi_results plugin looked up a document by its documentId without applying the current site's siteHash filter or the frontend user-group access filter. An anonymous visitor who knew or guessed a valid documentId could therefore retrieve access-restricted documents through the detail view — a path that was less restricted than the regular search.

The direct documentId lookup now applies the same siteHash and frontend user-group filters as the normal search path. A documentId that resolves to no accessible document — unknown, from another site, or restricted for the current visitor — yields the site's configured 404 page. The response is uniform, so it cannot be used to probe whether a restricted document exists.

As defence in depth, review whether your templates still expose data-document-id and mask it where the document id should not be publicly visible.

!!! Security: page indexer no longer poisons the rootline cache (CVE-2026-56092) 

During a page-indexer sub-request, EXT:solr forced fe_group and extendToSubpages to public values on every pages record it touched, so the indexer itself would not be blocked by access restrictions. TYPO3 Core persists that same record into the shared, cross-request rootline cache.

An anonymous visitor could therefore reach a page whose access restriction was only inherited via extendToSubpages from an ancestor page, for as long as the poisoned cache entry survived — the restricted area's own root page (which carries its fe_group directly) was not affected.

The indexer no longer forges these fields. The access bypass it needed during indexing was already provided safely, without touching any persisted cache, by EXT:solr's other, unaffected listeners.

All Changes 

• [TASK] Remove guzzlehttp/psr7 <2.10.0 pin (upstream fix in guzzlehttp/guzzle 7.10.2) by @dkd-kaehm in #4660

All Changes 

• [BUGFIX] Pin guzzlehttp/psr7 to <2.10.0 by @dkd-kaehm in #4662
• [BUGFIX] Prevent c:0 variant and content leakage on fe_group-restricted pages by @dkd-kaehm in #4641
• [BUGFIX] facet URL encoding mismatch (spaces) when using urlParameterStyle=assoc by @dkd-hauser in #4626
• [BUGFIX] Correct field name casing for subTitle and navTitle in TypoScript queryFields by @amirarends in #4624
• [TASK] Add PHP 8.5 to version matrix on TYPO3 13 by @dkd-kaehm in #4599
• [TASK] Upgrade GitHub Actions to latest versions by @dkd-kaehm in #4599
• [BUGFIX] GeneralUtility::trimExplode(): Argument #2 ($string) must be of type string, int given by @kitzberger in #4586
• [BUGFIX] Cast result offset to integer by @SaschaNoLe in #4585
• [BUGFIX] Respect plugin TS in RelevanceComponent by @helhum in #4538
• [BUGFIX] Catch InvalidArgumentException for missing site languages in GarbageHandler by @mikelwohlschlegel in #4537
• [BUGFIX] Add headers palette to solr plugin CType TCA definitions by @dkd-kaehm in #4535
• [BUGFIX] CS issues 2026.02.05 by @dkd-kaehm in #4535

!!! Upgrade to Apache Solr 9.10.1 

Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance!

• CVE-2025-54988: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs
• CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests
• CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

New in this release 

Key Highlights 

1. Initial Vector Search Introduction:

   • The EXT:solr version 13.1 introduces an initial vector search option as a new search variant.
   • Activating this feature automatically generates vectors during indexing and frontend search.
   • A connected large language model (LLM) is required for operation, though it is not directly related to EXT:solr.

2. Handling and Limitations of Vector Search:

   • Current implementation includes limitations, especially in error handling when required LLMs are not defined, leading to potential impairments in indexing or search.
   • Indexing without vector calculation results in documents not being found despite successful index status.
   • A missing or unavailable LLM during search attempts can lead to a SolrInternalServerErrorException, returning an HTTP status 500.

3. Configuring a Large Language Model:

   • To use vector search, a large language model must be connected to encode text into vectors.
   • Configuration details are available in the Apache Solr Reference Guide 9.9.

   • Models can be uploaded using a JSON file and cURL command.

     Example configuration for the JSON file

     {
       "class": "dev.langchain4j.model.openai.OpenAiEmbeddingModel",
       "name": "llm",
       "params": {
         "baseUrl": "https://api.openai.com/v1",
         "apiKey": "apiKey-openAI",
         "modelName": "text-embedding-3-small",
         "timeout": 5,
         "logRequests": true,
         "logResponses": true,
         "maxRetries": 2
       }
     }

     Copied!
   • The number of dimensions for vectors defaults to 768 but can be adjusted via the SOLR_VECTOR_DIMENSION environment variable.

Future Developments 

• Improved Error Handling: Future versions plan to enhance error handling during vector indexing and search to increase robustness and reliability.
• Additional Query Types: New query types such as vector sorting and vector re-ranking are planned, allowing for more advanced search result manipulation.
• Backend Module for LLM Management: A backend module for managing large language models is anticipated, simplifying maintenance and configuration for developers.

This introduction marks a significant advancement for TYPO3's search capabilities by integrating AI technologies, with ongoing improvements and features planned for future releases.

For more detailed technical implementation and setup instructions, users should refer to the version 13.1 release notes and the associated documentation sections.

Technical insights 

As soon as vector search is enabled, EXT:solr will use the connected LLM to generate vectors during indexing and for each search in the frontend. During indexing vectors are generated based on field vectorContent which is by default filled with the contents of the content field. TypoScript indexing configurations can be used to customize the contents of the vectorContent field, e.g.:

plugin.tx_solr.index.queue.news.fields {
  vectorContent = SOLR_CONTENT
  vectorContent.cObject = COA
  vectorContent.cObject {
    10 = TEXT
    10 {
      field = name
    }

    15 = TEXT
    15 {
      field = bodytext
    }
  }
}

During indexing vectors will be created and stored in field vector.

All Changes 

• [FEATURE] Add DenseVectorField in schemas by @dkd-kaehm in #4439
• [TASK] Prepare branch for 13.1.x versions by @dkd-kaehm in #4443
• [TASK] 13.0.x-dev Update solarium/solarium requirement from 6.3.7 to 6.4.1 by @dependabot[bot] in #4435
• [BUGFIX] don't use pages uid 0 via l10n_parent by @dkd-kaehm in #4449
• Remove OpenSearch profile link by @infabo in #4418
• [FEATURE] Initial vector search by @dkd-friedrich in #4446
• [FEATURE] Cascade fe_group changes with extendToSubpages (reindex + cleanup) by @DavRet in #4400
• [TASK] Switch dependabot to supported branches: 13.1.x and 12.1.x by @dkd-kaehm in #4454
• [BUGFIX] pass a request with page id to Configuration manager by @WebsiteDeveloper in #4452
• [BUGFIX] Initialize the localRootLine property before usage by @davidlemaitre in #4423
• Adjust resource identifier in PageRenderer asset registration in backend module template by @chrrynobaka in #4386
• [TASK] 13.1.x-dev Bump solr from 9.9.0 to 9.10.0 in /Docker/SolrServer by @dependabot[bot] in #4462
• Fix bug for phrase, bigramPhrase and trigramPhrase searches with slops by @Oktopuce in #4460
• [BUGFIX] Describe array shape of findTranslationOverlaysByPageId correctly by @smichaelsen in #4482
• [DOCS] Mention rootline for __pageSections to work by @kitzberger in #4478
• Update ConfigureRouting.rst by @simonduerr in #4477
• [FEATURE] Add dateRange field type in schema by @tillhoerner in #4461
• [BUGFIX] Replace TSFE call for page type by @sebkln in #4458
• [FEATURE] Improve BeforeSearchFormIsShownEvent by @simonschaufi in #4481
• [TASK] Replace md5/sha1 calls with hash method by @thomashohn in #4437
• [FEATURE] Add HEALTHCHECK to Dockerfile by @dkd-kaehm in #4484
• [BUGFIX] Respect site configuration when resolving page ID for TSFE initialization by @sfroemkenjw in #4421
• [TASK] Improve vector search documentation by @dkd-friedrich in #4491
• [BUGFIX] PHP Warning: Trying to access array offset on value of type null by @kitzberger in #4330
• [BUGFIX] Check if facet value is set by @spoonerWeb in #4493
• [BUGFIX] Check if variable is set and string by @spoonerWeb in #4495
• !!![FEATURE] allow nested TypoScript on multiValue fields by @dkd-kaehm in #4485