CVE-2025-48207: Insecure Direct Object Reference in renolit/reint-downloadmanager TYPO3 Extension
Summary
CVE-2025-48207: reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference. Affects renolit/reint-downloadmanager across 2 version ranges.
< 4.0.2
>= 5.0.0, < 5.0.1
Fixed in 4.0.2 or 5.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The renolit/reint-downloadmanager is a TYPO3 extension designed to manage file downloads efficiently. It provides functionalities for users to download files securely and manage access to these files. However, it has been identified that this extension is vulnerable to an Insecure Direct Object Reference (IDOR), which can lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'downloaduid' parameter in the downloadAction method of the renolit/reint-downloadmanager extension. This allows remote attackers to manipulate the parameter and gain access to arbitrary files on the server. The potential ramifications include unauthorized data exposure, which could lead to privacy breaches and data leaks. The vulnerability is classified under CWE-425 and CWE-639, indicating issues related to insufficient access control and insecure direct object references.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.0.24.0.2composer require renolit/reint-downloadmanager:4.0.2 -
>= 5.0.0, < 5.0.15.0.1composer require renolit/reint-downloadmanager:5.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the downloadAction method by implementing additional access controls or validation checks on the 'downloaduid' parameter to prevent unauthorized access.
Conclusion
The renolit/reint-downloadmanager TYPO3 extension is vulnerable to an Insecure Direct Object Reference, which can lead to unauthorized file access. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, implementing access controls can serve as a temporary workaround while the update is performed.
See every vulnerability recorded for renolit/reint-downloadmanager →
FAQ
The vulnerability is an Insecure Direct Object Reference (IDOR) that allows unauthorized access to files via manipulation of the 'downloaduid' parameter.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential data breaches, and privacy violations.
Yes, the vulnerability has been patched in versions 5.0.1 and 4.0.2 of the renolit/reint-downloadmanager package.
The CVSS score of this vulnerability is 4.9, indicating a moderate level of severity.
