medium6.0
CVE-2025-7899
Powermail extension for TYPO3 allows Insecure Direct Object Reference
Impact
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | in2code/powermail | >= 12.0.0, < 12.5.3 | 12.5.3 |
Affected products
| Product | Affected versions |
|---|---|
| Powermail Version 12.0.0 | before 12.5.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.