CVE-2026-57581

MEDIUM 5.3

DotVVM: Unrestricted file upload

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CWE	CWE-434
Vendor	riganti
Product	dotvvm
Published	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for riganti dotvvm

Be the first to know when new medium vulnerabilities affecting riganti dotvvm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

riganti / dotvvm

< 4.2.11 >= 4.3.0, < 4.3.15 >= 5.0.0-preview01, < 5.0.0-preview09-final

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4 github.com: https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585 github.com: https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5 github.com: https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef github.com: https://github.com/riganti/dotvvm/releases/tag/v4.3.15 github.com: https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09