Description

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T18:17:58.567Z",
  "pubdate": "2026-09-14T18:17:58.567Z",
  "executiveSummary": "A critical vulnerability exists in DotVVM, specifically within the DotvvmFileUploadMiddleware, where improper validation allows unauthenticated remote attackers to upload arbitrary files.\nThe vulnerability type is an unauthenticated file upload leading to resource exhaustion, categorized as a Denial of Service (DoS).\nAffected products include DotVVM versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final.\nThe primary risk implication is the rapid depletion of server-side storage, which can crash the application or prevent legitimate operations by exhausting disk space.\nExploitation does not require authentication or valid X-DotVVM-UploadToken generation, allowing any remote user to interact directly with the middleware.\nThis represents a significant availability risk for web applications hosting DotVVM with file upload storage enabled.",
  "technicalDetails": "The vulnerability resides within the DotvvmFileUploadMiddleware component, which is responsible for processing file upload requests in DotVVM applications.\nThe root cause is a failure in the request validation logic that incorrectly assumes all incoming file uploads originate from the legitimate DotVVM FileUpload component.\nNormally, legitimate uploads are expected to carry an X-DotVVM-UploadToken, which serves as a validation mechanism to ensure the request is authorized by the client-side framework.\nBecause the middleware fails to enforce the presence and validity of this token before processing the multipart/form-data payload, it becomes susceptible to direct, unauthenticated HTTP requests.\nAn attacker can bypass the intended framework-level security controls by crafting raw HTTP requests directed at the file upload endpoint. These requests bypass the requirement for a valid UI-bound token.\nThe attack flow follows a repetitive pattern: the attacker sends a series of large or numerous small POST requests to the DotvvmFileUploadMiddleware endpoint. Since the application fails to verify the source or authorization status of the request, the middleware processes each request and writes the payload to the configured server storage directory.\nBy automating these requests, an attacker can continuously fill the application's file storage quota or the physical disk partition hosting the temporary or permanent storage path.\nThe impact of this behavior is a state of resource exhaustion. Once the allocated storage limit is reached or the disk partition becomes full, the application experiences a Denial of Service. This may impact not only the file upload functionality but also other system processes dependent on the same storage medium.\nWhile DotvvmConfiguration.Security.AuthorizeFileUpload provides a mechanism to restrict access, the flaw in the middleware’s core request handling logic renders the file upload pipeline vulnerable to exploitation even if specific security configurations have been applied in certain deployment contexts.\nThe vulnerability is present in versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, after which the middleware was patched to enforce proper validation of the upload context."
}