Cloudanix VulnDB

CVE-2026-45260

High · 8.1

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

CVSS

8.1

EPSS

0.6%

Published

May 27, 2026

CISA due date

—

The record

Pimcore's WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an authentication plugin in the WebDAV controller. The `Tree::move()` implementation then performs asset mutation and deletion before checking a current Pimcore user or any asset permissions. An unauthenticated remote attacker who knows two existing asset paths in the same directory can send a WebDAV `MOVE` request that deletes the source asset. Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities