DotVVM: Unrestricted file upload
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| riganti | dotvvm | before 4.2.11; 4.3.0 to before 4.3.15; 5.0.0-preview01 to before 5.0.0-preview09-final | 4.2.11, 4.3.15, 5.0.0-preview09-final | Patch available | CNA |
- dotvvm Vendorriganti Affected before 4.2.11; 4.3.0 to before 4.3.15; 5.0.0-preview01 to before 5.0.0-preview09-final Fixed in 4.2.11, 4.3.15, 5.0.0-preview09-final Patch available CNA
Remediation
- Fix · CNA dotvvm (riganti) Fixed in 4.2.11, 4.3.15, 5.0.0-preview09-final
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57581
References
Other 6
- https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4
- https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585
- https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5
- https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef
- https://github.com/riganti/dotvvm/releases/tag/v4.3.15
- https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09
More riganti vulnerabilities
- TI-2026-41429 DotVVM: Missing authorization in AuthorizeActionFilter CVSS 4.0CRITICAL 9.2
- TI-2026-41428 DotVVM: ReDOS in routing CVSS 4.0HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences