CVE-2026-45260: Pimcore WebDAV Auth Bypass Vulnerability

CVE-2026-45260 Overview

CVE-2026-45260 is a missing authorization vulnerability [CWE-862] in Pimcore, an open source Data and Experience Management Platform. The flaw resides in the WebDAV asset endpoint, which exposes a MOVE operation through /asset/webdav{path} without an authentication plugin. The affected code paths in bundles/CoreBundle/src/Controller/WebDavController.php and models/Asset/WebDAV/Tree.php perform asset mutation and deletion through models/Asset.php before validating the current Pimcore user or the required rename, delete, create, or publish permissions. Authenticated users with low privileges can trigger unauthorized asset deletion, moves, or overwrites. Pimcore fixed the issue in versions 11.5.17 (LTS) and 12.3.7.

Critical Impact
A low-privileged authenticated attacker can delete, move, or overwrite arbitrary assets through the WebDAV MOVE operation, resulting in high impact to integrity and availability of the platform's managed content.

Affected Products

Pimcore versions prior to 11.5.17 (LTS branch)
Pimcore versions prior to 12.3.7 (12.x branch)
Deployments exposing the /asset/webdav endpoint

Discovery Timeline

2026-07-17 - CVE-2026-45260 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-45260

Vulnerability Analysis

The vulnerability stems from missing authorization checks in Pimcore's WebDAV asset interface. The controller at bundles/CoreBundle/src/Controller/WebDavController.php registers a Sabre DAV server that handles MOVE requests against the /asset/webdav{path} route. The Sabre server was configured without an authentication plugin, and the tree implementation in models/Asset/WebDAV/Tree.php invoked asset mutation methods on models/Asset.php before verifying the current user session or the granular rename, delete, create, and publish permissions.

As a result, a MOVE request that renames or relocates an asset bypasses Pimcore's role-based access control. The operation propagates directly to underlying asset storage, allowing overwrite of target files and deletion of source entries. This maps to Missing Authorization [CWE-862].

Root Cause

Authorization enforcement was absent from the WebDAV request handling path. The tree class did not resolve the acting Pimcore user or check permissions before persisting MOVE changes. Sabre DAV server instantiation omitted an authentication plugin, so no server-level access control preceded the tree callbacks.

Attack Vector

The attack is remote over the network and requires low privileges but no user interaction. An attacker sends a crafted WebDAV MOVE HTTP request against /asset/webdav/<target-path> with a Destination header pointing at an asset the attacker is not authorized to modify. The server processes the move without checking the caller's rename, delete, create, or publish rights.

php

// Security patch in models/Asset/WebDAV/Tree.php
// Source: https://github.com/pimcore/pimcore/commit/9d7c77fd9b19fa011ce470de95d4438e65007d99
 use Pimcore\Logger;
 use Pimcore\Model\Asset;
 use Pimcore\Model\Element;
+use Pimcore\Tool\Admin;
 use Pimcore\Tool\Serialize;
 use Sabre\DAV;
+use Sabre\DAV\Exception\Forbidden;
 
 /**
  * @internal

The patch imports Pimcore\Tool\Admin to resolve the current user and Sabre\DAV\Exception\Forbidden to reject unauthorized MOVE operations before any asset mutation occurs.

Detection Methods for CVE-2026-45260

Indicators of Compromise

Unexpected HTTP MOVE requests against /asset/webdav/ paths in web server access logs.
Asset modification, rename, or deletion events in Pimcore audit logs performed by accounts that lack the corresponding rename, delete, or publish permissions.
WebDAV Destination headers referencing asset paths outside the requesting user's normal working scope.

Detection Strategies

Enable and centralize Pimcore application logs plus front-end web server access logs, then alert on MOVE verbs directed at /asset/webdav.
Correlate WebDAV MOVE activity with the authenticated user's assigned permissions to flag operations that should have been denied.
Baseline normal WebDAV usage per user and alert on sudden bulk move or overwrite activity.

Monitoring Recommendations

Monitor filesystem changes in the Pimcore asset storage directory for unexpected deletions or overwrites.
Track database asset table mutations, including path and modification timestamp changes, for anomalies tied to WebDAV sessions.
Alert when the WebDAV endpoint is reachable from network segments that should not have administrative access to the platform.

How to Mitigate CVE-2026-45260

Immediate Actions Required

Upgrade Pimcore to 11.5.17 (LTS) or 12.3.7 or later without delay.
Audit Pimcore user accounts and revoke WebDAV access for accounts that do not require it.
Review recent asset change history and restore any assets that were moved, overwritten, or deleted by unauthorized users.

Patch Information

The fix is delivered in Pimcore 11.5.17 (LTS) and 12.3.7. See the GitHub Security Advisory GHSA-wc7j-g8wx-m2qx, the remediation pull request, and the patch commit 9d7c77f. Release notes are available in the v12.3.7 release.

Workarounds

Block the /asset/webdav route at the reverse proxy or web application firewall until the upgrade is applied.
Deny HTTP MOVE requests to the Pimcore instance at the network layer for untrusted user groups.
Restrict WebDAV endpoint access to authenticated administrators via IP allow-listing or VPN-only access.

bash

# Example nginx block for the vulnerable endpoint until patching
location ^~ /asset/webdav {
    limit_except GET { deny all; }
    return 403;
}