CVE-2025-7899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-7899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-7899
Aliases
Published
2025-07-22T10:18:38.449Z
Modified
2026-07-08T07:05:32.321780062Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Insecure Direct Object Reference in extension "powermail" (powermail)
Details

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7899.json",
    "cna_assigner": "TYPO3",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/in2code-de/powermail

Affected ranges

Type
GIT
Repo
https://github.com/in2code-de/powermail
Events
Introduced
0b7c1a8521ef6ffc0bc02f6433bb8c62e373f5a6
Last affected
f4cbdf04ef7ec881938072596943637ae9f56f4d
Introduced
a2433bc40702e84e7401b073f3581e0a3e0a0145
Last affected
a2433bc40702e84e7401b073f3581e0a3e0a0145
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "last_affected": "12.5.2"
        },
        {
            "introduced": "13.0.0"
        },
        {
            "last_affected": "13.0.0"
        }
    ]
}

Affected versions

13.*
13.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7899.json"