CVE-2026-57581: DotVVM: Unrestricted file upload
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 4.2.11 - Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 4.3.15 - Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 5.0.0-preview09-final - Configuration
Configure DotvvmConfiguration.Security.AuthorizeFileUpload to restrict which users may upload files (prevents unauthenticated file uploads).
DotVVM DotvvmConfiguration.Security.AuthorizeFileUpload = restricted to authorized users
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated storage exhaustion?
Applications using an affected DotVVM version and configured file upload storage are exposed. An unauthenticated user can submit files directly to DotvvmFileUploadMiddleware without a FileUpload-component-generated X-DotVVM-UploadToken.
What does an attacker need to exploit this issue?
The attacker needs network access to the application’s upload middleware; no credentials or user interaction are required. They can repeatedly upload files to consume application storage and cause denial of service.
Can upload access be restricted before upgrading?
DotvvmConfiguration.Security.AuthorizeFileUpload can restrict which users may upload files. This can reduce exposure while upgrading to 4.2.11, 4.3.15, or 5.0.0-preview09-final.