MEDIUM

GHSA-x769-3cwv-f8hc

Powermail extension for TYPO3 allows Insecure Direct Object Reference

Quick fix

GHSA-x769-3cwv-f8hc — in2code/powermail: upgrade to the fixed version with the command below.

composer require in2code/powermail:^12.5.3

Details

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/in2code/powermail

Introduced in: 12.0.0Fixed in: 12.5.3

Fixcomposer require in2code/powermail:^12.5.3

Packagist/in2code/powermail

Introduced in: 13.0.0Fixed in: 13.0.1

Fixcomposer require in2code/powermail:^13.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2025-7899[ADVISORY]
https://github.com/in2code-de/powermail/commit/b39e129c5e2a797f0ccf271fea220c7933ca77bc[WEB]
https://github.com/in2code-de/powermail[PACKAGE]
https://typo3.org/security/advisory/typo3-ext-sa-2025-009[WEB]