GitHub Advisoryadvisory · Packagist

GHSA-x769-3cwv-f8hc Powermail extension for TYPO3 allows Insecure Direct Object Reference

MEDIUM Published 2025-07-22 Modified 2025-07-22 Official page ↗
Aliases
CVE-2025-7899
Ecosystem
Packagist
Packages
in2code/powermail
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2025-07-22

Affected packages

• Packagist in2code/powermail: >= 12.0.0, < 12.5.3 → fixed in 12.5.3 • Packagist in2code/powermail: >= 13.0.0, < 13.0.1 → fixed in 13.0.1

Description

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.

Related

Alias · CVE (1)

  • CVE-2025-7899 The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References