CVE-2025-48207 reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
Attackers can access unauthorized files via insecure direct object references in the reint_downloadmanager extension for TYPO3.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48207?
CVE-2025-48207 is a high-severity missing authorization vulnerability in TYPO3 reint downloadmanager extension, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
Weakness: CWE-425
Which versions are affected by CVE-2025-48207?
4 open source packages ship an affected version, including renolit/reint-downloadmanager.
| Package | Affected | Fixed in |
|---|---|---|
renolit/reint-downloadmanager Packagist | All versions | 4.0.2 |
renolit/reint-downloadmanager Packagist | All versions | 4.0.2 |
renolit/reint-downloadmanager Packagist | From 5.0.0 | 5.0.1 |
renolit/reint-downloadmanager Packagist | From 5.0.0 | 5.0.1 |
How do I fix CVE-2025-48207?
Upgrade renolit/reint-downloadmanager to a fixed version for your release line: 4.0.2 or 5.0.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-48207 being exploited?
There is no known exploitation of CVE-2025-48207 in the wild and no public exploit code.
Sources
Also known as GHSA-jjwh-4x89-7f5w.