CVE-2025-7899: Insecure Direct Object Reference in extension "powermail" (powermail)
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/in2code/powermailto a version that resolves this vulnerability.Fixed in 13.0.1 - Upgrade
Upgrade
composer/in2code/powermailto a version that resolves this vulnerability.Fixed in 12.5.3 - Upgrade
Upgrade
TYPO3 powermailto a version that resolves this vulnerability.Fixed in 12.5.3 - Upgrade
Upgrade
TYPO3 powermailto a version that resolves this vulnerability.Fixed in 13.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7899?
CVE-2025-7899 is classified as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-7899?
To fix CVE-2025-7899, update the powermail extension to version 12.5.3 or later.
Which versions of powermail are affected by CVE-2025-7899?
CVE-2025-7899 affects powermail versions 12.0.0 through 12.5.2 and version 13.0.0.
What type of vulnerability is CVE-2025-7899?
CVE-2025-7899 is an Insecure Direct Object Reference vulnerability allowing the download of arbitrary files.
What software does CVE-2025-7899 impact?
CVE-2025-7899 impacts the powermail extension for TYPO3.