What’s Vulnerable › Vulnerabilities
CVE-2025-7899: Insecure Direct Object Reference in extension "powermail" (powermail)
- Severity: medium (CVSS 6.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-22 · updated 2026-06-17
- Weakness: CWE-639
Description
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
Affected products
- TYPO3 Extension "powermail": from 12.0.0 through 12.5.2; 13.0.0
References
Get alerted when CVE-2025-7899 or the next vulnerability affects your stack