{"id":"GHSA-2rm3-333w-xvc4","title":"DotVVM: Unrestricted file upload","summary":"DotVVM: Unrestricted file upload","severity":"medium","cvss":5.3,"cwe":["CWE-434"],"vendor":"DotVVM","product":"DotVVM","affected":["DotVVM < 4.2.11","DotVVM > 4.3.0-preview01-final, < 4.3.15","DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final"],"patched":["DotVVM 4.2.11","DotVVM 4.3.15","DotVVM 5.0.0-preview09-final"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2rm3-333w-xvc4","references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4"},{"url":"https://github.com/advisories/GHSA-2rm3-333w-xvc4"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T15:52:21.100Z","ecosystem":"nuget","slug":"GHSA-2rm3-333w-xvc4","body":"## Overview\n\n### Impact\n\nAll users of DotVVM with configured file upload storage are affected.\n\nDotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk. \n\n### Patches\n\nSince version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to have a cryptographic token, which is automatically generated by the FileUpload component. This means that users without access to any page with the FileUpload component cannot upload any files.\n\nThe patch also add the `DotvvmConfiguration.Security.AuthorizeFileUpload` option which allow you to further restrict which users can upload files. \n\n### Workarounds\n\nAs a workaround, you can temporarily disable file upload by removing `AddUploadedFileStorage` or `AddDefaultTempStorage` from your DotVVM configuration.\n\nEven with the patch, we recommend configuring file upload to use a dedicated partition with limited size.\n\n### References\n\n* DotVVM file upload configuration: https://www.dotvvm.com/docs/4.0/pages/concepts/upload-and-download-files/upload-files\n\n## Affected packages\n\n- `DotVVM < 4.2.11`\n- `DotVVM > 4.3.0-preview01-final, < 4.3.15`\n- `DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `DotVVM 4.2.11`\n- `DotVVM 4.3.15`\n- `DotVVM 5.0.0-preview09-final`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}