{"id":"CVE-2026-57581","aliases":["EUVD-2026-77698","GHSA-2rm3-333w-xvc4"],"status":"published","title":"DotVVM: Unrestricted file upload","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00593,"percentile":0.48845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2026-06-19T15:09:18Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"NuGet","package":"DotVVM","fixed_in":["4.2.11","4.3.15","5.0.0-preview09-final"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"UNPARSED","raw":"\u003e 4.3.0-preview01-final, \u003c 4.3.15","events":[{"fixed":"4.3.15"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-preview01-final"},{"fixed":"5.0.0-preview09-final"}]}]}],"products":[{"vendor":"riganti","product":"dotvvm"}],"references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/releases/tag/v4.3.15","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2rm3-333w-xvc4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57581.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57581","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57581","title":"DotVVM: Unrestricted file upload","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:35:30.58Z","modified":"2026-09-16T15:56:36.035Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-77698","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:35:30Z","modified":"2026-09-16T15:56:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:15.407859Z"}],"ghsa":[{"id":"GHSA-2rm3-333w-xvc4","title":"DotVVM: Unrestricted file upload","description":"### Impact\n\nAll users of DotVVM with configured file upload storage are affected.\n\nDotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk. \n\n### Patches\n\nSince version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to have a cryptographic token, which is automatically generated by the FileUpload component. This means that users without access to any page with the FileUpload component cannot upload any files.\n\nThe patch also add the `DotvvmConfiguration.Security.AuthorizeFileUpload` option which allow you to further restrict which users can upload files. \n\n### Workarounds\n\nAs a workaround, you can temporarily disable file upload by removing `AddUploadedFileStorage` or `AddDefaultTempStorage` from your DotVVM configuration.\n\nEven with the patch, we recommend configuring file upload to use a dedicated partition with limited size.\n\n### References\n\n* DotVVM file upload configuration: https://www.dotvvm.com/docs/4.0/pages/concepts/upload-and-download-files/upload-files","status":"published","published":"2026-06-19T15:09:18Z","modified":"2026-06-19T15:09:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:40:30.53004Z"}],"nvd":[{"id":"CVE-2026-57581","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T18:17:58.567Z","modified":"2026-09-30T17:51:56.193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-57581","title":"DotVVM: Unrestricted file upload","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:35:30.58Z","modified":"2026-10-28T02:31:08.622565352Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:45:12.016252Z"}]}}