MEDIUM
Insecure Direct Object Reference in extension "powermail" (powermail)
Published Jul 22, 2025
6.0
MEDIUMCVSS 4.0
EPSS 0.28%
Description
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
Affected products
-
- Version 12.0.0StatusaffectedConstraints<=12.5.2
- Version 13.0.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TYPO3 | Extension "powermail" | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner TYPO3
Published Jul 22, 2025
Updated Jul 22, 2025
Reserved Jul 19, 2025
Link CVE-2025-7899
CISA Vulnrichment
GHSA-X769-3CWV-F8HC Updated Jul 22, 2025