CVE-2025-7899

Insecure Direct Object Reference in extension "powermail" (powermail)

6.0 MediumFix available

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.33%Up 0.3 points since Jul 22, 2025

What each source reports

CVE List Score used 6.0

Insecure Direct Object Reference in extension "powermail" (powermail)

Record: CVE-2025-7899
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2025-22306 6.0

Record: EUVD-2025-22306
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x769-3cwv-f8hc 6.0

Powermail extension for TYPO3 allows Insecure Direct Object Reference

Record: GHSA-x769-3cwv-f8hc
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

NVD 6.0

Record: CVE-2025-7899
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-639
Updated: 2026-11-02

OSV 6.0

Insecure Direct Object Reference in extension "powermail" (powermail)

Record: CVE-2025-7899
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

OSVGHSA-x769-3cwv-f8hc 6.0

Powermail extension for TYPO3 allows Insecure Direct Object Reference

Record: GHSA-x769-3cwv-f8hc
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

Affected products

typo3 extension "powermail"

Affected packages

Affected packages
Package	Affected	Fixed
`in2code/powermail` Packagist	12.0.0 up to 12.5.3	12.5.3
`in2code/powermail` Packagist	13.0.0 to 13.0.0	13.0.1
`in2code/powermail` Packagist	12.0.0 up to 12.5.3, plus listed versions 12.0.112.0.212.0.312.1.012.1.1 Show 16 moreShow less 12.2.012.2.112.3.012.3.112.3.212.3.312.3.412.3.512.4.012.4.112.4.212.4.312.4.412.5.012.5.112.5.2	12.5.3
`in2code/powermail` Packagist	13.0.0 up to 13.0.1	13.0.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-7899 is a medium vulnerability (CVSS 6.0) in Typo3 Extension "powermail", published July 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in in2code/powermail 12.5.3.