Medium severity · published Sep 14, 2026
CVE-2026-57581
DotVVM: Unrestricted file upload
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dotvvm · riganti
< 4.2.11; >= 4.3.0, < 4.3.15; >= 5.0.0-preview01, < 5.0.0-preview09-final · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57581
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57581
github.com
https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585
github.com
https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5
github.com
https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef
github.com
https://github.com/riganti/dotvvm/releases/tag/v4.3.15
github.com
https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09
github.com
https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4
More from dotvvm
9.2
CVE-2026-57578
DotVVM: Missing authorization in AuthorizeActionFilter
8.2
CVE-2026-57577
DotVVM: ReDOS in routing