CVE-2025-7899 — Insecure Direct Object Reference in extension "powermail" (powermail)

CVE-2025-7899

Insecure Direct Object Reference in extension "powermail" (powermail) PUBLISHED

Description (CNA)

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "powermail"	affected 12.0.0 through 12.5.2; affected 13.0.0

CWE

CWE-639

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-009

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.