CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection
Attackers with email access can inject HTML into admin-sent emails, potentially stealing session cookies and altering page content.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-30166?
CVE-2025-30166 is a low-severity cross-site scripting vulnerability in pimcore admin-ui-classic-bundle, published on 8 Apr 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.
Weakness: CWE-79
Which versions are affected by CVE-2025-30166?
2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.7.6 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.7.6 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2025-30166?
Upgrade pimcore/admin-ui-classic-bundle to 1.7.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-30166 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30166 exists.
Other vulnerabilities in pimcore admin-ui-classic-bundle
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
Sources
Also known as GHSA-x82r-6j37-vrgg.