CVE-2026-57581

Name of the Vulnerable Software and Affected Versions DotVVM versions prior to 4.2.11 DotVVM versions prior to 4.3.15 DotVVM versions prior to 5.0.0-preview09-final

Description Applications using configured file upload storage allow unauthenticated users to submit files directly to the DotvvmFileUploadMiddleware without a required X-DotVVM-UploadToken generated by the FileUpload component. This allows an attacker to repeatedly upload files to fill the application storage, resulting in a denial of service.

Recommendations Update to version 4.2.11. Update to version 4.3.15. Update to version 5.0.0-preview09-final. Use DotvvmConfiguration.Security.AuthorizeFileUpload to restrict which users are permitted to upload files.