Is CVE-2026-57581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57581 being exploited in the wild.

How severe is CVE-2026-57581?

Medium severity, with a CVSS score of 5.3, published 14 September 2026.

Which products and versions are affected?

Riganti DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Is there a fix for CVE-2026-57581?

A patch was published on 2026-06-18: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57581 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57581?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57581: DotVVM unauthenticated file upload denial of service

CVE-2026-57581 · Severity: medium · CVSS 5.3 · Published 2026-09-14

DotVVM is an open-source web framework that allows applications to accept file uploads from users. Versions before 4.2.11, 4.3.15, and 5.0.0-preview09-final have a flaw that allows anyone on the internet to upload files without authentication, even if the application requires it for normal users. An attacker can repeatedly upload files to exhaust the application's storage and cause service outage.

Quick answers

Is CVE-2026-57581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57581 being exploited in the wild.
How severe is CVE-2026-57581?: Medium severity, with a CVSS score of 5.3, published 14 September 2026.
Which products and versions are affected?: Riganti DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Is there a fix for CVE-2026-57581?: A patch was published on 2026-06-18: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57581 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57581?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the DotvvmFileUploadMiddleware, which processes file uploads. The middleware fails to validate the X-DotVVM-UploadToken header that should be generated by the legitimate FileUpload component, allowing unauthenticated users to submit files directly. The root cause is missing token validation in the middleware request handling. An attacker can send repeated multipart requests to the upload endpoint without any authentication or valid token. This enables a denial-of-service attack by filling application storage. The DotvvmConfiguration.Security.AuthorizeFileUpload option, when configured, is also bypassed. The issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final by adding mandatory token validation.

Affected products

Riganti DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final

Timeline

2026-09-14: disclosed
2026-06-18: patched: Fix committed to main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.