Executive brief
DotVVM is an open-source web framework that allows applications to accept file uploads from users. Versions before 4.2.11, 4.3.15, and 5.0.0-preview09-final have a flaw that allows anyone on the internet to upload files without authentication, even if the application requires it for normal users. An attacker can repeatedly upload files to exhaust the application's storage and cause service outage.
Technical details
The vulnerability exists in the DotvvmFileUploadMiddleware, which processes file uploads. The middleware fails to validate the X-DotVVM-UploadToken header that should be generated by the legitimate FileUpload component, allowing unauthenticated users to submit files directly. The root cause is missing token validation in the middleware request handling. An attacker can send repeated multipart requests to the upload endpoint without any authentication or valid token. This enables a denial-of-service attack by filling application storage. The DotvvmConfiguration.Security.AuthorizeFileUpload option, when configured, is also bypassed. The issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final by adding mandatory token validation.
Affected products
- Riganti DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final
Timeline
- 2026-09-14: disclosed
- 2026-06-18: patched: Fix committed to main branch