What is GHSA-x769-3cwv-f8hc?

GHSA-x769-3cwv-f8hc is a security advisory published by GitHub Security Advisories with Medium severity. Powermail extension for TYPO3 allows Insecure Direct Object Reference

Which CVE IDs does GHSA-x769-3cwv-f8hc cover?

GHSA-x769-3cwv-f8hc covers the following CVE IDs: CVE-2025-7899. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-x769-3cwv-f8hc?

GHSA-x769-3cwv-f8hc affects 2 products, including: composer/in2code/powermail:\u003e= 12.0.0, \u003c 12.5.3; composer/in2code/powermail:= 13.0.0.

GHSA-x769-3cwv-f8hcMedium

Powermail extension for TYPO3 allows Insecure Direct Object Reference

Vendor

GitHub Security Advisories

Published

July 22, 2025

Last Modified

July 22, 2025

🔗 CVE IDs covered (1)

CVE-2025-7899 →

📋 Description

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.

🎯 Affected products2

composer/in2code/powermail:>= 12.0.0, < 12.5.3
composer/in2code/powermail:= 13.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-7899
https://typo3.org/security/advisory/typo3-ext-sa-2025-009
https://github.com/in2code-de/powermail/commit/b39e129c5e2a797f0ccf271fea220c7933ca77bc
https://github.com/advisories/GHSA-x769-3cwv-f8hc