{"id":"GHSA-6q65-j4jw-9cg8","aliases":[],"status":"published","title":"DotVVM allows path traversal when deployed in Debug mode","description":"### Description\n\nThere is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).\n\n### Patches\n\nThe bug is patched in versions  **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer).\n\nApart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).\n\n### Workarounds\n\nIf you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:\n\n```\n    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM\n```","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-06-19T14:40:30Z","modified":"2025-06-19T15:01:15Z","fixes":[{"ecosystem":"NuGet","package":"DotVVM","fixed_in":["4.3.8","5.0.0-preview03-final","4.2.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-preview01-final"},{"last_affected":"4.3.7"},{"fixed":"4.3.8"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-preview01-final"},{"fixed":"5.0.0-preview03-final"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10"}]}]},{"source":"osv","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-preview01-final"},{"fixed":"4.3.8"}]}],"versions":["4.3.0","4.3.0-preview01-final","4.3.0-preview02-final","4.3.0-preview03-final","4.3.0-preview04-final","4.3.0-preview05-final","4.3.0-preview06-final","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7"]},{"source":"osv","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-preview01-final"},{"fixed":"5.0.0-preview03-final"}]}],"versions":["5.0.0-preview01-final","5.0.0-preview02-final"]},{"source":"osv","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10"}]}],"versions":["0.6.0-pre","0.7.0-pre","0.7.0.1-pre","0.7.0.2-pre","0.7.0.3-pre","0.7.0.4-pre","0.7.0.5-pre","0.7.0.6-pre","0.7.0.7-pre","0.7.0.8-pre","0.8.0-pre","0.8.1-pre","0.8.1.1-pre","0.8.1.2-pre","0.8.2-pre","0.8.2.1-pre","0.8.2.2-pre","0.8.2.3-pre","0.8.3-pre","0.8.3.1-pre","0.8.3.10-pre","0.8.3.2-pre","0.8.3.3-pre","0.8.3.4-pre","0.8.3.5-pre","0.8.3.6-pre","0.8.3.7-pre","0.8.3.8-pre","0.8.3.9-pre","0.8.4-pre","0.8.4.1-pre","0.8.4.2-pre","0.8.5-pre","0.8.5.1-pre","0.8.5.10-pre","0.8.5.2-pre","0.8.5.3-pre","0.8.5.4-pre","0.8.5.5-pre","0.8.5.6-pre","0.8.5.7-pre","0.8.5.8-pre","0.8.5.9-pre","0.8.6-pre","0.8.6.1-pre","0.8.6.13-pre","0.8.6.2-pre","0.8.6.3-pre","0.8.6.4-pre","0.8.6.5-pre","0.8.6.6-pre","0.8.6.7-pre","0.9.0","1.0.0","1.0.0-beta","1.0.0-rc","1.0.0-rc2","1.0.0.7-rc2","1.0.1","1.0.2","1.0.5","1.1.0","1.1.0-alpha","1.1.0-beta","1.1.0-rc","1.1.0-rc3","1.1.0-rc5","1.1.0.1","1.1.1","1.1.2","1.1.5","1.1.6","1.1.6.1","1.1.6.2","1.1.6.3","1.1.7","1.1.8","1.1.8.1","1.1.8.2","1.1.9","1.1.9.1","1.1.9.2","1.1.9.3","1.1.9.4","1.2.0-alpha1","2.0.0","2.0.0-beta-01","2.0.0-beta01","2.0.0-preview01-final","2.0.0-preview02-final","2.0.0-preview03-final","2.0.0-preview04-final","2.0.0-preview05-final","2.0.0-preview06-final","2.0.0-preview07-final","2.0.0-preview08-final","2.0.1","2.0.1-preview01-final","2.0.1-preview02-final","2.0.1-preview03-final","2.0.1-preview04-final","2.0.1-preview05-final","2.0.2","2.0.3","2.0.3-preview01-final","2.0.3-preview02-final","2.1.0","2.1.0-preview01-final","2.2.0","2.2.0-preview01-final","2.2.0-preview02-final","2.2.0-preview03-final","2.2.0.1","2.2.0.2","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.0-preview01-final","2.4.0-preview03-final","2.4.0-preview06-final","2.4.0.1","2.5.0","2.5.0-preview02-final","2.5.0-preview04-final","2.5.1","2.5.2","3.0.0","3.0.0-preview02-final","3.0.0-preview03-final","3.0.0-preview04-final","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.0-preview01-final","3.1.0-preview02-final","3.1.0-preview03-final","3.1.0-preview04-final","3.1.0-preview05-final","3.1.0-preview07-final","3.1.1","3.2.0","3.2.0-preview01-final","3.2.0-preview02-final","3.2.1","3.2.2","3.2.3","4.0.0","4.0.0-preview01-final","4.0.0-preview02-final","4.0.0-preview03-final","4.0.0-preview05","4.0.0-preview05-final","4.0.0-preview06-final","4.0.0-preview07-final","4.0.0-preview08-final","4.0.0-preview09-final","4.0.0-preview10-final","4.0.0-preview11-final","4.0.0-preview13-final","4.0.0-preview15-final","4.0.1","4.0.10","4.0.11","4.0.12","4.0.12-preview04-569028","4.0.13","4.0.2","4.0.3","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0-preview01-final","4.1.0-preview03-final","4.1.0-preview04-final","4.1.0-preview05-final","4.1.0-preview06-final","4.1.0-preview07-final","4.1.0-preview09-final","4.1.0-preview10-final","4.1.0-preview11-final","4.1.0-preview12-final","4.1.0-preview13-final","4.1.0-preview14-final","4.1.0-preview18-final","4.1.0-preview19-final","4.1.0-preview21-final","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2.0","4.2.0-preview01-final","4.2.0-preview02-final","4.2.0-preview03-final","4.2.0-preview04-final","4.2.0-preview05-final","4.2.0-preview06-final","4.2.0-preview07-final","4.2.0-preview08-final","4.2.0-preview09-final","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]}],"references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-6q65-j4jw-9cg8","tags":["web"]},{"url":"https://github.com/riganti/dotvvm/commit/68db0110beeda4e8e4be1b7c4e480ef876895bb5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6q65-j4jw-9cg8"},{"url":"https://github.com/riganti/dotvvm","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-6q65-j4jw-9cg8","title":"DotVVM allows path traversal when deployed in Debug mode","description":"### Description\n\nThere is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).\n\n### Patches\n\nThe bug is patched in versions  **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer).\n\nApart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).\n\n### Workarounds\n\nIf you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:\n\n```\n    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM\n```","status":"published","published":"2025-06-19T14:40:30Z","modified":"2025-06-19T14:40:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"osv":[{"id":"GHSA-6q65-j4jw-9cg8","title":"DotVVM allows path traversal when deployed in Debug mode","description":"### Description\n\nThere is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).\n\n### Patches\n\nThe bug is patched in versions  **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer).\n\nApart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).\n\n### Workarounds\n\nIf you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:\n\n```\n    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM\n```","status":"published","published":"2025-06-19T14:40:30Z","modified":"2025-06-19T15:01:15.59259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}