HTML Injection Vulnerability in Pimcore's Admin Classic Bundle

CVE-2025-30166

What is CVE-2025-30166?

The Admin Classic Bundle from Pimcore is vulnerable to an HTML injection issue that can be exploited through the email sending feature within the admin interface. This allows authenticated users with access to send emails to inject arbitrary HTML content, leading to potential session cookie theft and unauthorized alterations to the displayed page content. This vulnerability is particularly risky as it was identified in the /admin/email/send-test-email endpoint, specifically affecting the 'content' parameter. Although there are filters in place to block JavaScript code injection, HTML code injection remains unfiltered, emphasizing the need for immediate attention and updates to version 1.7.6 or later to mitigate these risks. For further details, refer to the relevant security advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References