Cross-site scripting in Pimcore admin-ui-classic-bundle - CVE-2025-30166
Published: April 8, 2025 / Updated: July 22, 2026
Vulnerability identifier: #VU139117
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-30166
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject arbitrary HTML into emails sent via the admin interface.
The vulnerability exists due to cross-site scripting in the /admin/email/send-test-email endpoint when processing the content parameter in POST requests. A remote privileged user can submit crafted HTML content to inject arbitrary HTML into emails sent via the admin interface.
JavaScript injection is filtered, but HTML injection remains possible. User interaction is required to view the crafted email.
Affected software
Pimcore admin-ui-classic-bundle
How to mitigate CVE-2025-30166
Install security update from vendor's website.
Pimcore admin-ui-classic-bundle - update to 1.7.6