CVE-2025-30166

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30166
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e Patch
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
History

04 Nov 2025, 18:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
First Time Pimcore admin Classic Bundle
Pimcore
CPE cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
Summary
  • (es) El paquete Admin Classic de Pimcore proporciona una interfaz de usuario backend para Pimcore. Un problema de inyección de HTML permite a los usuarios con acceso a la función de envío de correos electrónicos inyectar código HTML arbitrario en los correos enviados a través de la interfaz de administración, lo que podría provocar el robo de cookies de sesión y la alteración del contenido de la página. La vulnerabilidad se descubrió en el endpoint /admin/email/send-test-email mediante el método POST. El parámetro vulnerable es content, lo que permite la inyección de código HTML arbitrario durante el proceso de envío de correos electrónicos. Si bien la inyección de código JavaScript se bloquea mediante filtrado, la inyección de código HTML sigue siendo posible. Esta vulnerabilidad se corrigió en la versión 1.7.6.
References () https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e - () https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e - Patch
References () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg - () https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg - Third Party Advisory

08 Apr 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-08 11:15

Updated : 2025-11-04 18:45

NVD link : CVE-2025-30166

Mitre link : CVE-2025-30166

CVE.ORG link : CVE-2025-30166

JSON object : View

Products Affected

pimcore

  • admin_classic_bundle
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')