CVE-2025-30166: Pimcore/admin ui classic bundle Pimcore's Admin Classic Bundle Allows Vulnerability

LOW
Advisory Identifier: GHSA-x82r-6j37-vrgg
Share
CWE-79
Published
Advisory Summary

CVE-2025-30166 is a LOW pimcore's admin classic bundle allows vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Pimcore/admin ui classic bundle libraries in the Packagist ecosystem. The issue involves pimcore's admin classic bundle allows html injection. Remediation is available by upgrading affected packages to version 1.7.6.

CVE-2025-30166 at a Glance

CVE Identifier CVE-2025-30166
GHSA Identifier GHSA-x82r-6j37-vrgg
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product Pimcore/admin ui classic bundle
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2025-30166

To remediate this vulnerability, upgrade all affected Pimcore/admin ui classic bundle dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pimcore/admin-ui-classic-bundle fixed: 1.7.6 
Upgrade pimcore/admin-ui-classic-bundle to 1.7.6
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for pimcore/admin-ui-classic-bundle

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-30166, inspect your project dependencies for Pimcore/admin ui classic bundle:

inspect dependencies for pimcore/admin-ui-classic-bundle

Analyze the terminal output to locate any version of Pimcore/admin ui classic bundle in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.7.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Pimcore/admin ui classic bundle, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. ### Details The vulnerability was discovered in the `/admin/email/send-test-email` endpoint using the `POST` method. The vulnerable parameter is `content`, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. ### PoC To reproduce the vulnerability, a user must fill out the email's content form with the desired HTML payload. ![send-test-mail-text](https://github.com/user-attachments/assets/0e02b004-ce88-4018-b7cb-ae15a8ec2300) ### Impact ![mail-text](https://github.com/user-attachments/assets/67080d10-0cef-4f65-a157-4f012203f0a3) This HTML injection vulnerability can potentially enable phishing attacks by allowing the insertion of any html like fake login forms, etc. All functionalities that process user input should be carefully reviewed to ensure that data is appropriately encoded as HTML entities in server responses. For instance, a reflected input paramete like `<h1> just a test </h1> <p> <img>` should be displayed in the HTML response as `&#x3c;h1&#x3e; just a test &#x3c;/h1&#x3e; &#x3c;p&#x3e; &#x3c;img&#x3e;`.

CVE-2025-30166 Affected Pimcore/admin ui classic bundle Versions

1 component(s)
Fixed Versions:
1.7.6
Product / Package Ecosystem Affected Versions Fixed Version
pimcore/admin-ui-classic-bundle
 Packagist
< 1.7.6
1.7.6

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg
NVD — CVE-2025-30166 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30166
Security Fix Commit FIX COMMIT
https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e
Pimcore/admin ui classic bundle Source Repository REPOSITORY
https://github.com/pimcore/admin-ui-classic-bundle

Frequently Asked Questions

What is CVE-2025-30166?
CVE-2025-30166 is a security vulnerability in Pimcore/admin ui classic bundle involving Pimcore's Admin Classic Bundle allows HTML Injection under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which Pimcore/admin ui classic bundle versions are affected?
Affected versions include releases prior to 1.7.6 across affected packages: pimcore/admin-ui-classic-bundle.
What version fixes CVE-2025-30166?
Upgrading to 1.7.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pimcore/admin-ui-classic-bundle affected?
Yes, pimcore/admin-ui-classic-bundle is affected in releases prior to 1.7.6. Upgrade your dependency to 1.7.6 or later.
What CWE is associated with CVE-2025-30166?
CVE-2025-30166 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check Packagist dependencies for CVE-2025-30166?
Run the dependency tree command: 'inspect dependencies for pimcore/admin-ui-classic-bundle'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x82r-6j37-vrgg",
  "modified" : "2025-04-08T14:51:41Z",
  "published" : "2025-04-08T14:51:41Z",
  "aliases" : [ "CVE-2025-30166" ],
  "summary" : "Pimcore's Admin Classic Bundle allows HTML Injection",
  "details" : "### Summary\nAn HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content.\n\n### Details\nThe vulnerability was discovered in the `/admin/email/send-test-email` endpoint using the `POST` method. The vulnerable parameter is `content`, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible.\n\n### PoC\nTo reproduce the vulnerability, a user must fill out the email's content form with the desired HTML payload.\n![send-test-mail-text](https://github.com/user-attachments/assets/0e02b004-ce88-4018-b7cb-ae15a8ec2300)\n\n### Impact\n![mail-text](https://github.com/user-attachments/assets/67080d10-0cef-4f65-a157-4f012203f0a3)\n\nThis HTML injection vulnerability can potentially enable phishing attacks by allowing the insertion of any html like fake login forms, etc.\nAll functionalities that process user input should be carefully reviewed to ensure that data is appropriately encoded as HTML entities in server responses. For instance, a reflected input paramete like `<h1> just a test </h1> <p> <img>` should be displayed in the HTML response as `&#x3c;h1&#x3e; just a test &#x3c;/h1&#x3e; &#x3c;p&#x3e; &#x3c;img&#x3e;`.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pimcore/admin-ui-classic-bundle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.7.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30166"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-08T14:51:41Z",
    "nvd_published_at" : "2025-04-08T11:15:44Z"
  }
}