CVE-2025-7899

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download ofarbitraryfiles from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
TYPO3CNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://typo3.org/security/advisory/typo3-ext-sa-2025-009