The blast occurred at about 1:50 pm in a central aisle close to the main altar of the Basilica of Our Lady of the Pilar in the city of Zaragoza, and people were evacuated, said a spokesman for the Interior Ministry's office there.
The explosion occurred just three days before the city's yearly Pilar festival, which attracts tens of thousands of people.
The official said no group has taken responsibility for the device, which was being examined by police. The official spoke on condition of anonymity because of department rules preventing him from being identified.
The church, dating back to the 12th century, takes its name from a stone pillar located inside, which some faithful believe was left there by the Virgin Mary. The pillar was not damaged by today's explosion.
Pope John Paul II visited the cathedral in 1984.