Read the docs
TI-2025-21505 Aliases CVE-2025-30166GHSA-x82r-6j37-vrgg

Pimcore's Admin Classic Bundle allows HTML Injection

Priority MEDIUM 43CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Fixed admin-ui-classic-bundle (pimcore): 1.7.6pimcore/admin-ui-classic-bundle (Packagist): 1.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcoreadmin-ui-classic-bundlebefore 1.7.61.7.6Patch availableCNA
—pimcore/admin-ui-classic-bundle (Packagist)before 1.7.61.7.6Patch availableGHSA-x82r-6j37-vrgg
  • admin-ui-classic-bundle Vendorpimcore Affected before 1.7.6 Fixed in 1.7.6 Patch available CNA
  • pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.7.6 Fixed in 1.7.6 Patch available GHSA-x82r-6j37-vrgg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*before 1.7.6Vulnerablepimcore
  • cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions before 1.7.6 Vulnerable ·pimcore

Remediation

  • Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.7.6
  • Fix · GHSA-x82r-6j37-vrgg pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.7.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30166
  2. 2026-10-03 Alias added: GHSA-x82r-6j37-vrgg

References

Patch 1

Advisory 2

Other 1

  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
  • TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
  • TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
  • TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences