# Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

Unauthenticated WebDAV MOVE on Pimcore's asset endpoint deletes the source asset before any user or permission check runs.

- Payout: Research
- Severity: high
- Program: Pimcore
- Found by: larlarua, kingjia90
- Disclosed: 2026-05-27
- CVE: CVE-2026-45260
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wc7j-g8wx-m2qx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wc7j-g8wx-m2qx
- Tags: area:web domain:web impact:dos impact:integrity kind:research platform:ghsa sev:high tech:php technique:source-review vuln:access-control vuln:auth-bypass

**Target:** WebDAV asset endpoint /asset/webdav{path} (SabreDAV Tree::move)
**Root cause:** The WebDAV controller attaches no auth plugin, and Tree::move() deletes the source asset in the same-directory overwrite branch before resolving the current user or checking rename/delete/create/publish permissions.
**Steps:**
1. Identify two existing asset paths in the same directory, e.g. `/products/source.jpg` and `/products/existing.jpg`.
2. Send unauthenticated `MOVE /asset/webdav/products/source.jpg HTTP/1.1` with `Destination: http://target.example/asset/webdav/products/existing.jpg` and `Overwrite: T`.
3. Server errors at `$user->getId()` but `$sourceAsset->delete()` already removed `/products/source.jpg`.
**How found:** Code review of the WebDAV controller (no auth plugin attached) and Tree::move(), noticing the same-directory overwrite branch calls $sourceAsset->delete() before Admin::getCurrentUser() and before any isAllowed() check.
**Exploitation:** Attacker needs only known/guessable asset paths; a single unauthenticated MOVE with Overwrite:T triggers the same-directory branch that copies destination data and deletes the source asset before the missing-user failure, yielding destruction of the source asset.
**Escalation:** Low-privileged authenticated backend users can also reach the unchecked path to overwrite destination assets or move assets without per-asset rename/delete/create/publish permission checks.
**Insight:** In SabreDAV-backed endpoints, audit each Tree/Node method separately: most operations gate on isAllowed(), but move() often bypasses it, and side effects ordered before the user lookup still execute on unauthenticated requests.

## Proof of concept (copied exactly from the original report)

**Unauthenticated WebDAV MOVE request deleting source asset**

```
MOVE /asset/webdav/products/source.jpg HTTP/1.1
Host: target.example
Destination: http://target.example/asset/webdav/products/existing.jpg
```