Main Vulnerability Database SB20250408100

SB20250408100 - Cross-site scripting in Pimcore admin-ui-classic-bundle

Published: April 8, 2025 Updated: July 22, 2026

Security Bulletin ID SB20250408100

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2025-30166)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to inject arbitrary HTML into emails sent via the admin interface.

The vulnerability exists due to cross-site scripting in the /admin/email/send-test-email endpoint when processing the content parameter in POST requests. A remote privileged user can submit crafted HTML content to inject arbitrary HTML into emails sent via the admin interface.

JavaScript injection is filtered, but HTML injection remains possible. User interaction is required to view the crafted email.

Remediation

Install update from vendor's website.

References

https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg