Pimcore’s WebDAV asset endpoint exposes a MOVE operation at /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php. The logic for asset mutation and deletion is carried out in models/Asset/WebDAV/Tree.php and models/Asset.php before any checks of the current Pimcore user or the rename, delete, create, or publish permissions. This allows an unauthenticated attacker to delete, move, or overwrite assets. The flaw is a failure of proper access control identified as CWE‑862, which can compromise the integrity of all assets stored in the instance and potentially disrupt business applications that rely on those assets. The issue is fixed in Pimcore versions 11.5.17 (LTS) and 12.3.7.

Affected systems include any Pimcore installation that is running an older version of the platform: 11.x prior to 11.5.17 (long‑term support) and 12.x prior to 12.3.7. The vulnerability does not present in newer releases where the issue has been fixed. Organizations that use Pimcore for content, digital asset management, or e‑commerce should verify their current version against these thresholds.

The CVSS score of 8.1 indicates a high severity, and the EPSS score of less than 1% suggests that exploitation in the wild is currently rare, but the flaw remains a known security weakness. Because the attack vector can be exercised remotely via an unauthenticated HTTP WebDAV MOVE request, any host exposed to the internet or an internal network can be targeted without credential compromise. The vulnerability is not listed in the CISA KEV catalog, but its high impact on data integrity warrants prompt remediation. Attackers would need only network access to the asset WebDAV endpoint to perform the unauthorized operations.