CVE-2025-7899: Insecure Direct Object Reference in Powermail Extension for TYPO3
Summary
CVE-2025-7899: Powermail extension for TYPO3 allows Insecure Direct Object Reference. Affects in2code/powermail across 2 version ranges.
>= 12.0.0, < 12.5.3
>= 13.0.0, < 13.0.1
Fixed in 12.5.3 or 13.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Powermail extension for TYPO3 is a popular tool used for creating and managing forms within TYPO3 websites. It provides features such as customizable form fields, validation, and email notifications. However, certain versions of Powermail are vulnerable to an Insecure Direct Object Reference (IDOR) issue, which can lead to unauthorized access to sensitive files on the web server.
Vulnerability Detail
The vulnerability arises from improper access controls in the Powermail extension, allowing attackers to exploit the system and download arbitrary files from the web server. This can lead to exposure of sensitive information, including configuration files, user data, and other critical resources. The affected versions are Powermail 12.0.0 to 12.5.2 and 13.0.0. The issue is classified under CWE-639, indicating a failure to enforce proper authorization checks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.5.312.5.3composer require in2code/powermail:12.5.3 -
>= 13.0.0, < 13.0.113.0.1composer require in2code/powermail:13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to the Powermail extension or implement additional access controls at the server level to prevent unauthorized file downloads until the extension is updated.
Conclusion
The Powermail extension for TYPO3 has a significant vulnerability that can lead to unauthorized file access. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help secure the application until the update is completed.
See every vulnerability recorded for in2code/powermail →
FAQ
CVE-2025-7899 is a vulnerability in the Powermail extension for TYPO3 that allows for Insecure Direct Object Reference, enabling unauthorized file downloads.
The affected versions are Powermail 12.0.0 to 12.5.2 and 13.0.0.
You can fix this vulnerability by updating to Powermail version 12.5.3 or 13.0.1 using the command: composer update in2code/powermail.
The risks include unauthorized access to sensitive files on the web server, which could lead to data breaches and exposure of confidential information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
