https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:33:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339082 EUVD-2026-339082 https://cve.radiocsirt.org/vuln/euvd-2026-339082 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45260 <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore&#39;s WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore&#39;s WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45260 https://cve.radiocsirt.org/vuln/ghsa-wc7j-g8wx-m2qx <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>### Summary Pimcore&#39;s WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an authentication plugin in the WebDAV controller. The `Tree::move()` implementation then performs asset mutation and deletion before checking a current Pimcore user or any asset permissions.</p> <p>An unauthenticated remote attacker who knows two existing asset paths in the same directory can send a WebDAV `MOVE` request that deletes the source asset. Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions.</p> <p>### Details The route for WebDAV is globally registered and accepts arbitrary trailing paths:</p> <p>```yaml # bundles/CoreBundle/config/routing.yaml pimcore_webdav: path: /asset/webdav{path} defaults: { _controller: Pimcore\Bundle\CoreBundle\Controller\WebDavController::webdavAction } requirements: path: &#39;.*&#39; ```</p> <p>The controller constructs a SabreDAV server but only attaches lock and browser plugins. It does not attach an authentication plugin or perform an explicit user/session check before starting the server:</p> <p>```php # bundles/CoreBundle/src/Controller/WebDavController.php $publicDir = new Asset\WebDAV\Folder($homeDir); $objectTree = new Asset\WebDAV\Tree($publicDir); $server = new \Sabre\DAV\Server($objectTree); $server-&gt;setBaseUri($this-&gt;generateUrl(&#39;pimcore_webdav&#39;, [&#39;path&#39; =&gt; &#39;/&#39;])); $server-&gt;a…</p> <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>### Summary Pimcore&#39;s WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an authentication plugin in the WebDAV controller. The `Tree::move()` implementation then performs asset mutation and deletion before checking a current Pimcore user or any asset permissions.</p> <p>An unauthenticated remote attacker who knows two existing asset paths in the same directory can send a WebDAV `MOVE` request that deletes the source asset. Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions.</p> <p>### Details The route for WebDAV is globally registered and accepts arbitrary trailing paths:</p> <p>```yaml # bundles/CoreBundle/config/routing.yaml pimcore_webdav: path: /asset/webdav{path} defaults: { _controller: Pimcore\Bundle\CoreBundle\Controller\WebDavController::webdavAction } requirements: path: &#39;.*&#39; ```</p> <p>The controller constructs a SabreDAV server but only attaches lock and browser plugins. It does not attach an authentication plugin or perform an explicit user/session check before starting the server:</p> <p>```php # bundles/CoreBundle/src/Controller/WebDavController.php $publicDir = new Asset\WebDAV\Folder($homeDir); $objectTree = new Asset\WebDAV\Tree($publicDir); $server = new \Sabre\DAV\Server($objectTree); $server-&gt;setBaseUri($this-&gt;generateUrl(&#39;pimcore_webdav&#39;, [&#39;path&#39; =&gt; &#39;/&#39;])); $server-&gt;a…</p> https://cve.radiocsirt.org/vuln/ghsa-wc7j-g8wx-m2qx