PT-2026-44148 · Git+2 · Pimcore+1

CVE-2026-45260 · Published 2026-05-27 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.17 (LTS) Pimcore versions prior to 12.3.7

Description The WebDAV asset endpoint exposes a MOVE operation through the '/asset/webdav{path}' endpoint without an authentication plugin in the WebDavController.php controller. The Tree::move() function performs asset mutation and deletion before verifying the current user or checking for rename, delete, create, or publish permissions. This allows an unauthenticated remote attacker who knows two existing asset paths in the same directory to send a request that deletes the source asset. Additionally, authenticated users with low privileges may perform unauthorized asset moves or overwrites. This can lead to data loss, loss of content integrity, and service disruption.

Recommendations Update Pimcore to version 11.5.17 (LTS). Update Pimcore to version 12.3.7.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-45260

GHSA-WC7J-G8WX-M2QX

Affected Products

Pimcore

Pimcore/Pimcore

References · 10

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-wc7j-g8wx-m2qx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45260.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45260 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc7j-g8wx-m2qx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45260 · Security Note
• https://github.com/pimcore/pimcore/commit/9d7c77fd9b19fa011ce470de95d4438e65007d99 · Note
• https://github.com/pimcore/pimcore/pull/19120 · Note
• https://github.com/pimcore/pimcore/releases/tag/v12.3.7 · Note
• https://github.com/pimcore/pimcore · Note
• https://t.me/cveNotify/208379 · Telegram Post