CVE-2025-30166: HTML Injection Vulnerability in Pimcore Admin Classic Bundle
Summary
CVE-2025-30166: Pimcore's Admin Classic Bundle allows HTML Injection. Affects pimcore/admin-ui-classic-bundle versions < 1.7.6. Fixed in 1.7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pimcore is an open-source digital experience platform that provides a comprehensive suite of tools for managing digital assets, content, and product information. The Admin Classic Bundle is a key component of Pimcore, allowing users to manage emails and other administrative tasks. However, a vulnerability has been identified in this bundle that permits HTML injection, posing significant security risks.
Vulnerability Detail
An HTML injection vulnerability exists in the /admin/email/send-test-email endpoint of the Pimcore Admin Classic Bundle. This issue arises from the 'content' parameter, which allows users to inject arbitrary HTML code into emails sent via the admin interface. Although JavaScript injection is filtered, HTML code can still be injected, potentially leading to phishing attacks, session cookie theft, and content alteration. The vulnerability can be exploited by crafting a malicious email payload that includes HTML elements, which could deceive recipients into providing sensitive information.
How To Fix
Minimum fixed version
1.7.6
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:1.7.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the 'content' parameter to prevent HTML injection. This can be done by encoding user input as HTML entities before processing it. For example, you can use PHP's htmlspecialchars function: $safe_content =
htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
Conclusion
The HTML injection vulnerability in the Pimcore Admin Classic Bundle poses significant security risks, including phishing and session theft. It is crucial to update to the patched version 1.7.6 to mitigate these risks. Additionally, using Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
The vulnerability allows HTML injection through the email content parameter, which can lead to phishing attacks and session cookie theft.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file.
The risks include potential phishing attacks, unauthorized access to user sessions, and manipulation of email content.
Yes, a patch is available in version 1.7.6 of the Pimcore Admin Classic Bundle. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of HTML injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
