Read the docs
TI-2025-43694 Aliases GHSA-6q65-j4jw-9cg8

DotVVM allows path traversal when deployed in Debug mode

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Description There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets). ### Patches The bug is patched in versions **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer). Apart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords). ### Workarounds If you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class: ``` config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM ```

Why it matters now

Fix Fixed DotVVM (NuGet): 4.3.8, 5.0.0-preview03-final, 4.2.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DotVVM (NuGet)4.3.0-preview01-final to before 4.3.84.3.8Patch availableGHSA-6q65-j4jw-9cg8
—DotVVM (NuGet)5.0.0-preview01-final to before 5.0.0-preview03-final5.0.0-preview03-finalPatch availableGHSA-6q65-j4jw-9cg8
—DotVVM (NuGet)before 4.2.104.2.10Patch availableGHSA-6q65-j4jw-9cg8
  • DotVVM (NuGet) Vendor— Affected 4.3.0-preview01-final to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-6q65-j4jw-9cg8
  • DotVVM (NuGet) Vendor— Affected 5.0.0-preview01-final to before 5.0.0-preview03-final Fixed in 5.0.0-preview03-final Patch available GHSA-6q65-j4jw-9cg8
  • DotVVM (NuGet) Vendor— Affected before 4.2.10 Fixed in 4.2.10 Patch available GHSA-6q65-j4jw-9cg8

Remediation

  • Fix · GHSA-6q65-j4jw-9cg8 DotVVM (NuGet) Fixed in 4.3.8 Advisory →
  • Fix · GHSA-6q65-j4jw-9cg8 DotVVM (NuGet) Fixed in 5.0.0-preview03-final Advisory →
  • Fix · GHSA-6q65-j4jw-9cg8 DotVVM (NuGet) Fixed in 4.2.10 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-6q65-j4jw-9cg8

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences