URL: https://demo.pimcore.fun/admin/
In Setting select User/Roles and select User. After created user, move to Workspace tab and inject payload XSS at Documents, Assets and Data Objects. XSS payload will be trigger.
Besides, Workspace in Roles Also having the same situation. Can you create Role and move to Workspace tab and inject payload to Documents, Assets, Data Objectes.
//
payload = "><img src>
Image PoC: ![PoC_Image] (https://drive.google.com/file/d/1oUR2JXF8jQ1YMpuKNNqKe8TAJaCuZwL8/view?usp=sharing “poc”)