CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Attackers can delete, move, or overwrite assets via WebDAV without authentication due to missing authorization checks in Pimcore.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45260?
CVE-2026-45260 is a high-severity missing authorization vulnerability in pimcore, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
Weakness: CWE-862
Which versions are affected by CVE-2026-45260?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
How do I fix CVE-2026-45260?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.7 or 2026.1.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45260 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45260 exists.
Sources
Also known as GHSA-wc7j-g8wx-m2qx.