CVE-2025-30166: Pimcore's Admin Classic Bundle allows HTML Injection
Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content.
Details The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible.
PoC To reproduce the vulnerability, a user must fill out the email's content form with the desired HTML payload. !send-test-mail-text
Impact !mail-text
This HTML injection vulnerability can potentially enable phishing attacks by allowing the insertion of any html like fake login forms, etc. All functionalities that process user input should be carefully reviewed to ensure that data is appropriately encoded as HTML entities in server responses. For instance, a reflected input paramete like <h1> just a test </h1> <p> <img> should be displayed in the HTML response as <h1> just a test </h1> <p> <img>.
Other sources
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30166?
The severity of CVE-2025-30166 is rated as high due to the potential for HTML injection leading to session cookie theft.
How do I fix CVE-2025-30166?
To fix CVE-2025-30166, upgrade the Pimcore Admin Classic Bundle to version 1.7.6 or later.
Who is affected by CVE-2025-30166?
Users of Pimcore Admin Classic Bundle versions prior to 1.7.6 may be affected by CVE-2025-30166.
What is the main impact of CVE-2025-30166?
The main impact of CVE-2025-30166 is the ability for attackers to inject arbitrary HTML into emails, which may lead to phishing attacks.
How does CVE-2025-30166 affect email functionalities?
CVE-2025-30166 affects email functionalities by allowing unauthorized HTML code injection, compromising the integrity of communications.