HTML Injection Vulnerability in Pimcore's Admin Classic Bundle

CVE-2025-30166

Summary

The Admin Classic Bundle from Pimcore is vulnerable to an HTML injection issue that can be exploited through the email sending feature within the admin interface. This allows authenticated users with access to send emails to inject arbitrary HTML content, leading to potential session cookie theft and unauthorized alterations to the displayed page content. This vulnerability is particularly risky as it was identified in the /admin/email/send-test-email endpoint, specifically affecting the 'content' parameter. Although there are filters in place to block JavaScript code injection, HTML code injection remains unfiltered, emphasizing the need for immediate attention and updates to version 1.7.6 or later to mitigate these risks. For further details, refer to the relevant security advisories.

References