Description

I noticed that you filtered the input very carefully.

But there are still some parts you missed

Proof of Concept

1.Login in URL : https://demo.pimcore.fun/admin.

2.Go to "Search Documents" and filter only "Snippet" search and press search.

3.Go to "/en/shared/teasers/Popular Brands".

4.In the Edit section, press the "Edit Link" icon and edit the "Text" section -> enter the following xss:

                <img src=x onerror=javascript:alert(('1'))>

5.Save and the xss has been executed.

Video PoC

https://drive.google.com/file/d/18LNVcoZsluPMWb_VvHJkI_iKtpES_iLV/view?usp=sharing

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.