p PatchFirst

CVE-2025-7899

CVE-2025-7899 · Insecure Direct Object Reference in extension "powermail" (powermail)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

CVSS 6.0 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • extension "powermail"

    Versions
    • ≥ 12.0.0, ≤ 12.5.2: Affected (semver)
    • 13.0.0: Affected (semver)

    No fix published

  • in2code/powermail Packagist

    Versions
    • 12.0.0
    • 12.0.1
    • 12.0.2
    • 12.0.3
    • 12.1.0
    • 12.1.1
    • 12.2.0
    • 12.2.1
    • 12.3.0
    • 12.3.1
    • 12.3.2
    • 12.3.3
    • 12.3.4
    • 12.3.5
    • 12.4.0
    • 12.4.1
    • 12.4.2
    • 12.4.3
    • 12.4.4
    • 12.5.0
    • 12.5.1
    • 12.5.2
    Affected ranges
    • ECOSYSTEM: ≥ 12.0.0, < 12.5.3

    Update to 12.5.3

  • in2code/powermail Packagist

    Versions
    • 13.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.0.1

    Update to 13.0.1

Original sources

Check your server →