PT-2025-30394 · Typo3 · Powermail

CVE-2025-7899 · Published 2025-07-22 · Updated 2025-07-22

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions powermail versions 12.0.0 through 12.5.2 powermail version 13.0.0

Description The powermail extension for TYPO3 contains an Insecure Direct Object Reference issue that allows for the download of arbitrary files from the webserver.

Recommendations Update powermail to a version later than 12.5.2. Update powermail to a version later than 13.0.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-7899

GHSA-X769-3CWV-F8HC

Affected Products

Powermail

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7899.json · Exploit
• https://osv.dev/vulnerability/GHSA-x769-3cwv-f8hc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7899 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7899 · Vendor Advisory
• https://github.com/in2code-de/powermail · Note
• https://github.com/in2code-de/powermail/commit/b39e129c5e2a797f0ccf271fea220c7933ca77bc · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2025-009 · Note
• https://twitter.com/CVEnew/status/1947609924944408601 · Twitter Post
• https://t.me/cvenotify/129784 · Telegram Post
• https://t.me/CVEtracker/28368 · Telegram Post
• https://t.me/cvetracker/28368 · Telegram Post
• https://packagist.org · Note
• https://t.me/cveNotify/129784 · Telegram Post