CVE-2025-30166 Details
Description
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.
A vulnerability allowing HTML injection has been identified in the Pimcore Admin Classic Bundle, specifically in versions through 1.7.5. This issue arises in the email sending functionality within the Backend UI, where users can inject arbitrary HTML into emails. The vulnerability was found in the '/admin/email/send-test-email' endpoint, using the POST method. The 'content' parameter is the vector for injection, allowing users to embed HTML during the email dispatch process. Although JavaScript injection is filtered out, HTML injection remains feasible. This flaw could lead to session cookie theft and unauthorized alterations of page content.
Users can update to Pimcore Admin Classic Bundle version 1.7.6, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pimcore admin classic bundle | < 1.7.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | Initial Analysis | [email protected] |
| Apr 8, 2025 | New CVE Received | [email protected] |