File Upload Vulnerability in DotVVM Framework by Riganti
CVE-2026-57581
5.3MEDIUM
What is CVE-2026-57581?
DotVVM, an open-source MVVM framework, suffers from a vulnerability that allows unauthenticated users to upload files to the DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken. This flaw enables attackers to exploit the file upload functionality, which can lead to service disruption by overwhelming application storage. To mitigate this risk, developers can implement the DotvvmConfiguration.Security.AuthorizeFileUpload feature to limit upload access to authorized users. The vulnerability has been addressed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Affected Version(s)
dotvvm < 4.2.11 < 4.2.11
dotvvm >= 4.3.0, < 4.3.15 < 4.3.0, 4.3.15
dotvvm >= 5.0.0-preview01, < 5.0.0-preview09-final < 5.0.0-preview01, 5.0.0-preview09-final