{"action":"Upgrade pimcore/pimcore to 11.5.17 or later.","affected":[{"fixed":"12.3.7","introduced":"12.0.0-RC1"},{"fixed":"2026.1.3","introduced":"2026.1.0"},{"fixed":"11.5.17","introduced":"0"}],"component":"pimcore/pimcore","cve_ids":["CVE-2026-45260"],"ecosystem":"Packagist","epss":0.00636,"exploited":false,"fixed_versions":["12.3.7","2026.1.3","11.5.17"],"ghsa_id":"GHSA-wc7j-g8wx-m2qx","id":"tcs_01M5KF9ZZK78DSRJZQ568Q3SZW","modified_at":"2026-07-10T19:15:11.884188610Z","published_at":"2026-05-27T17:17:18Z","references":["https://osv.dev/vulnerability/GHSA-wc7j-g8wx-m2qx","https://github.com/pimcore/pimcore/security/advisories/GHSA-wc7j-g8wx-m2qx","https://github.com/pimcore/pimcore/pull/19120","https://github.com/pimcore/pimcore/commit/9d7c77fd9b19fa011ce470de95d4438e65007d99","https://github.com/pimcore/pimcore","https://github.com/pimcore/pimcore/releases/tag/v12.3.7"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-wc7j-g8wx-m2qx","url":"https://osv.dev/vulnerability/GHSA-wc7j-g8wx-m2qx"}],"summary":"Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling"}