VulnerabilityDeferred

CVE-2025-7899

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver.

MEDIUM 6.0EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

CVSS 4.0: 6.0 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: f4fb688c-4412-4426-b4b8-421ecf27b14a

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-009

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.