Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

DotVVM: Unrestricted file upload

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

cve-program · CVE-2026-57581

Published

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-57581

Published

dotvvm

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "riganti",
                    "product": "dotvvm",
                    "versions": [
                        {
                            "version": "< 4.2.11",
                            "status": "affected"
                        },
                        {
                            "version": ">= 4.3.0, < 4.3.15",
                            "status": "affected"
                        },
                        {
                            "version": ">= 5.0.0-preview01, < 5.0.0-preview09-final",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 11:05 UTC · 270 of 275 readable · 268 fully read · documentation 469/469 current