Insecure Direct Object Reference in extension "powermail" (powermail)
Priority LOW 27CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed in2code/powermail (Packagist): 12.5.3, 13.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TYPO3 | Extension "powermail" | 12.0.0 – 12.5.2; 13.0.0 | — | No fix listed | CNA |
| — | in2code/powermail (Packagist) | 12.0.0 to before 12.5.3 | 12.5.3 | Patch available | GHSA-x769-3cwv-f8hc |
| — | in2code/powermail (Packagist) | 13.0.0 to before 13.0.1 | 13.0.1 | Patch available | GHSA-x769-3cwv-f8hc |
- Extension "powermail" VendorTYPO3 Affected 12.0.0 – 12.5.2; 13.0.0 Fixed in — No fix listed CNA
- in2code/powermail (Packagist) Vendor— Affected 12.0.0 to before 12.5.3 Fixed in 12.5.3 Patch available GHSA-x769-3cwv-f8hc
- in2code/powermail (Packagist) Vendor— Affected 13.0.0 to before 13.0.1 Fixed in 13.0.1 Patch available GHSA-x769-3cwv-f8hc
Remediation
- Fix · GHSA-x769-3cwv-f8hc in2code/powermail (Packagist) Fixed in 12.5.3 Advisory →
- Fix · GHSA-x769-3cwv-f8hc in2code/powermail (Packagist) Fixed in 13.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7899
- 2026-10-03 Alias added: GHSA-x769-3cwv-f8hc
References
More TYPO3 vulnerabilities
- TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
- TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
- TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
- TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
- TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
- TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
Sources
- CVE-2025-7899 · CVE Program
- CVE-2025-7899 · NVD
- FIRST EPSS
- GHSA-x769-3cwv-f8hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences