Medium severity · published Jul 22, 2025
CVE-2025-7899
Insecure Direct Object Reference in extension "powermail" (powermail)
6.0
CVSS
0.3%
EPSS
No
On KEV
Description
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Extension "powermail" · TYPO3
12.0.0 through 12.5.2; 13.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7899
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2025-009
More from Extension "powermail"
9.5
CVE-2026-77136
Server-Side Template Injection in extension "powermail" (powermail)