Description

vuln was find in File/Documents/Home , any button in page

Proof of Concept

1. Login in  URL : https://demo.pimcore.fun/admin
2. Go to File -> Open Documents -> Home
3. click any button in page -> Edit Link  
4. in tab Advanced, inject payload to : ```Attributes (key="value")```

For more understanding please check POC.
// PoC.js
var payload = \'><details/open/ontoggle=confirm(document.domain)>
POC : https://drive.google.com/file/d/110JMIEA_ngdVB-k5cM9wnX8p7KtW7npD/view?usp=share_link

Impact

An attacker can use XSS to send a malicious script to any user.