CVE-2025-48205: Insecure Direct Object Reference in sjbr/sr-feuser-register Extension for TYPO3
Summary
CVE-2025-48205: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. This allows attackers to read arbitrary files. Affects sjbr/sr-feuser-register versions >= 5.1.0, < 12.5.0. Fixed in 12.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sjbr/sr-feuser-register extension for TYPO3 is designed to facilitate user registration on TYPO3 websites. It provides a user-friendly interface for managing front-end user registrations, including features for validation and user data handling. However, this extension has been found to be vulnerable to an Insecure Direct Object Reference (IDOR), which can lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability arises from improper access controls within the sjbr/sr-feuser-register extension, allowing attackers to exploit the system by directly referencing files that should be restricted. This can lead to unauthorized reading of arbitrary files on the server, potentially exposing sensitive information. The vulnerability affects versions up to 12.4.8 and is classified under CWE-425 and CWE-639, indicating issues related to file access and insecure references.
How To Fix
Minimum fixed version
12.5.0
This is the first release that contains the fix.
composer require sjbr/sr-feuser-register:12.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive files on your server by implementing proper file permissions and access controls. Additionally, consider reviewing the extension's configuration to limit file access where possible.
Conclusion
In summary, the CVE-2025-48205 vulnerability in the sjbr/sr-feuser-register extension poses a significant risk due to Insecure Direct Object Reference. It is essential to update to the patched version 12.5.0 to safeguard against potential unauthorized file access.
See every vulnerability recorded for sjbr/sr-feuser-register →
FAQ
CVE-2025-48205 is a vulnerability in the sjbr/sr-feuser-register extension for TYPO3 that allows for Insecure Direct Object Reference, enabling unauthorized file access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive files, which may result in data breaches or exposure of confidential information.
Yes, the patch is available in version 12.5.0 of the sjbr/sr-feuser-register extension. It is crucial to update to this version to mitigate the risk.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. It provides real-time alerts to help you maintain security.
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-feuser-register.
