CVE-2026-57581
Received Received - Intake

Unauthenticated File Upload DoS in DotVVM

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57581
EUVD
EUVD-2026-77698

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
dotvvm dotvvm to 4.2.11 (exc)
dotvvm dotvvm to 4.3.15 (exc)
dotvvm dotvvm to 5.0.0-preview09-final (exc)
riganti dotvvm 4.2.11
riganti dotvvm 4.3.15
riganti dotvvm 5.0.0-preview09-final
riganti dotvvm to 5.0.0-preview09-final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DotVVM is a framework for building web applications. In versions before 4.2.11, 4.3.15, and 5.0.0-preview09-final, it allowed unauthenticated users to upload files directly to a specific middleware without proper authorization. This could lead to attackers filling up storage space, causing a denial of service.

Detection Guidance

Check if your DotVVM application uses versions prior to 4.2.11, 4.3.15, or 5.0.0-preview09-final. Monitor file upload endpoints for unauthorized or excessive file uploads. Inspect storage usage for unexpected increases. Verify if X-DotVVM-UploadToken validation is enforced for file uploads.

Impact Analysis

If you use DotVVM with file upload functionality, an attacker could exploit this to upload large numbers of files, consuming all available storage. This would make the application unavailable to legitimate users due to lack of disk space.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized file uploads that may lead to data breaches or storage exhaustion. Unrestricted uploads risk exposing sensitive data or violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade DotVVM to versions 4.2.11, 4.3.15, or 5.0.0-preview09-final or later. Enable DotvvmConfiguration.Security.AuthorizeFileUpload to restrict file uploads to authorized users. Implement rate limiting on file upload endpoints to prevent excessive storage consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart