https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T02:00:24.571288+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339082 EUVD-2026-339082 2026-10-06T02:00:24.624072+00:00 EUVD-2026-339082 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45260 fkie_cve-2026-45260 2026-10-06T02:00:24.624111+00:00

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

 https://cve.radiocsirt.org/vuln/ghsa-wc7j-g8wx-m2qx GHSA-wc7j-g8wx-m2qx — Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling 2026-10-06T02:00:24.624147+00:00

Affected: Packagist: pimcore/pimcore

### Summary Pimcore's WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an authentication plugin in the WebDAV controller. The `Tree::move()` implementation then performs asset mutation and deletion before checking a current Pimcore user or any asset permissions.

An unauthenticated remote attacker who knows two existing asset paths in the same directory can send a WebDAV `MOVE` request that deletes the source asset. Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions.

### Details The route for WebDAV is globally registered and accepts arbitrary trailing paths:

```yaml # bundles/CoreBundle/config/routing.yaml pimcore_webdav: path: /asset/webdav{path} defaults: { _controller: Pimcore\Bundle\CoreBundle\Controller\WebDavController::webdavAction } requirements: path: '.*' ```

The controller constructs a SabreDAV server but only attaches lock and browser plugins. It does not attach an authentication plugin or perform an explicit user/session check before starting the server:

```php # bundles/CoreBundle/src/Controller/WebDavController.php $publicDir = new Asset\WebDAV\Folder($homeDir); $objectTree = new Asset\WebDAV\Tree($publicDir); $server = new \Sabre\DAV\Server($objectTree); $server->setBaseUri($this->generateUrl('pimcore_webdav', ['path' => '/'])); $server->a…