CVE-2025-30166: Pimcore Admin Classic Bundle XSS Vulnerability

CVE-2025-30166 Overview

CVE-2025-30166 is an HTML injection vulnerability in the Pimcore Admin Classic Bundle, which provides the backend user interface for Pimcore. The flaw resides in the /admin/email/send-test-email endpoint and affects the content POST parameter. Authenticated users with access to the email sending functionality can inject arbitrary HTML into outbound emails. JavaScript payloads are filtered, but HTML injection remains possible. The issue is classified as Cross-Site Scripting [CWE-79] and is fixed in version 1.7.6.

Critical Impact
Attackers with email-sending privileges can inject HTML into emails, enabling content spoofing, phishing lures, and potential session cookie theft against recipients who open crafted messages.

Affected Products

Pimcore Admin Classic Bundle versions prior to 1.7.6
pimcore:admin_classic_bundle package (Composer)
Pimcore deployments using the classic backend UI for email testing

Discovery Timeline

2025-04-08 - CVE-2025-30166 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30166

Vulnerability Analysis

The vulnerability exists in the EmailController of the Pimcore Admin Classic Bundle. The send-test-email action accepts a content parameter and passes it directly to the mail body without HTML sanitization. When emailType is set to text, the raw content is embedded in the outgoing message. Recipients rendering the message in an HTML-capable client see attacker-controlled markup rendered as part of the email. While script-tag filtering blocks direct JavaScript execution, HTML elements such as <a>, <img>, <iframe>, and <style> remain viable for phishing, tracking pixels, and content manipulation. Exploitation requires authenticated access to the admin interface with permissions to send test emails, which limits the practical attack surface to insider-adjacent scenarios or accounts obtained through separate compromise.

Root Cause

The controller passes user-supplied input to the mail body without sanitizing HTML tags. The strip_tags() function was missing from the text-email branch, allowing HTML markup to survive intact when rendered by mail clients.

Attack Vector

An authenticated attacker sends a POST request to /admin/email/send-test-email with a crafted content field containing HTML. The rendered email delivers spoofed content, external resource references, or crafted links to the recipient, supporting phishing and cookie-harvesting workflows.

php

// Security patch in src/Controller/Admin/EmailController.php
$mail = new Mail();

if ($request->get('emailType') == 'text') {
-    $mail->text($request->get('content'));
+    $mail->text(strip_tags($request->get('content')));
} elseif ($request->get('emailType') == 'html') {
    $mail->html($request->get('content'));
} elseif ($request->get('emailType') == 'document') {

Source: Pimcore Admin UI Classic Bundle commit 76b690d. The patch introduces strip_tags() on the text-email branch, removing HTML markup before delivery.

Detection Methods for CVE-2025-30166

Indicators of Compromise

POST requests to /admin/email/send-test-email containing HTML tags such as <a>, <img>, <iframe>, or <style> in the content field
Outbound test emails from Pimcore instances that include external image URLs or unexpected hyperlinks
Admin audit log entries showing test-email activity from accounts that do not typically send email

Detection Strategies

Inspect web server and application logs for send-test-email requests and flag payloads containing angle-bracket HTML elements
Correlate authenticated admin session activity with outbound SMTP traffic to identify anomalous test-email volume
Review recipient-side mail gateways for messages originating from Pimcore that contain suspicious anchor tags or remote images

Monitoring Recommendations

Enable request-body logging on the Pimcore admin endpoints and alert on HTML tag patterns in the content parameter
Monitor admin user accounts with email-send privileges for privilege changes or new account creation
Forward Pimcore application and web server logs to a centralized analytics platform for retention and correlation across sessions

How to Mitigate CVE-2025-30166

Immediate Actions Required

Upgrade the Pimcore Admin Classic Bundle to version 1.7.6 or later using Composer
Audit which admin roles have access to the email sending functionality and remove the permission from accounts that do not need it
Rotate credentials for admin accounts that show unexpected test-email activity in historical logs

Patch Information

The fix is available in Pimcore Admin Classic Bundle 1.7.6. The patch is tracked in commit 76b690d4f8fcd9c9d41766bc5238c2513242e60e and applies strip_tags() to the content parameter on the text-email branch. See GitHub Security Advisory GHSA-x82r-6j37-vrgg for advisory details.

Workarounds

Restrict access to the /admin/email/send-test-email endpoint using a reverse proxy or web application firewall rule until the patch is applied
Remove the email-send capability from non-essential admin roles in the Pimcore permission configuration
Apply an egress mail gateway policy that strips or rewrites HTML content in messages originating from Pimcore test-email flows

bash

# Update Pimcore Admin Classic Bundle via Composer
composer require pimcore/admin-ui-classic-bundle:^1.7.6
composer update pimcore/admin-ui-classic-bundle
bin/console cache:clear --env=prod