CVE-2025-48207
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
- Record
CVE-2025-48207- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
EUVDEUVD-2025-16025
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
- Record
EUVD-2025-16025- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jjwh-4x89-7f5w
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
Insecure Direct Object Reference in the reint_downloadmanager TYPO3 extension allows remote attackers to read arbitrary files via the downloaduid parameter in the downloadAction.
- Record
GHSA-jjwh-4x89-7f5w- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C - Weakness
- CWE-425, CWE-639
- Updated
- 2026-11-02
NVD
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
- Record
CVE-2025-48207- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
OSVGHSA-jjwh-4x89-7f5w
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
Insecure Direct Object Reference in the reint_downloadmanager TYPO3 extension allows remote attackers to read arbitrary files via the downloaduid parameter in the downloadAction.
- Record
GHSA-jjwh-4x89-7f5w- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C - Weakness
- CWE-425, CWE-639
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
renolit/reint-downloadmanagerPackagist |
5.0.0 up to 5.0.1 | 5.0.1 |
renolit/reint-downloadmanagerPackagist |
before 4.0.2 | 4.0.2 |
renolit/reint-downloadmanagerPackagist |
before 4.0.2, plus listed versions 1.5.01.6.01.6.11.7.01.8.0 Show 23 moreShow less2.0.02.0.12.0.22.0.32.0.43.0.03.0.13.0.23.0.33.0.43.0.53.0.63.1.03.1.13.2.03.2.13.2.23.2.33.2.43.2.53.2.64.0.04.0.1 |
4.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-48207 is a high vulnerability (CVSS 8.6) in Typo3 Reint Downloadmanager Extension, published May 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in renolit/reint-downloadmanager 5.0.1.
References
typo3.org/security/advisory/typo3-ext-sa-2025-004
github.com/Kephson/reint_downloadmanager/commit/99b07497f5842a59e934583283e1b5a477ce79a9
nvd.nist.gov/vuln/detail/CVE-2025-48207