pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations
Published 25 Sept 2023 · Updated 10 Sept 2026
Affected package
- Affected
- <1.1.2
- Fixed in
- 1.1.2
composer require pimcore/admin-ui-classic-bundle:^1.1.2Details
Impact
The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user.
The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box.
Patches
https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch
Workarounds
Update to version 1.1.2 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch
Is GHSA-m988-7375-7g2c in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/admin-ui-classic-bundle, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.