GHSA-x769-3cwv-f8hc

ghsaUSosv

Powermail extension for TYPO3 allows Insecure Direct Object Reference

view advisory published 2025-07-22Licence: CC-BY-4.0

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-7899US	—	0.33% (26th)	—	2025-07-22
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 u…

references

External citations — patches, advisories, analysis.

https://github.com/in2code-de/powermailPACKAGE
https://github.com/in2code-de/powermail/commit/b39e129c5e2a797f0ccf271fea220c7933ca77bcWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-7899ADVISORY
https://typo3.org/security/advisory/typo3-ext-sa-2025-009WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan