Pimcore WebDAV Unauthorized Asset Delete/Overwrite (11.5.16/12.3.6)
CVE-2026-45260 Published on July 17, 2026
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
Vulnerability Analysis
CVE-2026-45260 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-45260. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-45260 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-45260
Want to know whenever a new CVE is published for Pimcore? stack.watch will email you.
Affected Versions
pimcore:- Version < 11.5.17 is affected.
- Version >= 12.0.0, < 12.3.7 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.