---
id: GHSA-2rm3-333w-xvc4
title: 'DotVVM: Unrestricted file upload'
summary: 'DotVVM: Unrestricted file upload'
severity: medium
cvss: 5.3
cwe:
  - CWE-434
vendor: DotVVM
product: DotVVM
affected:
  - DotVVM < 4.2.11
  - 'DotVVM > 4.3.0-preview01-final, < 4.3.15'
  - 'DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final'
patched:
  - DotVVM 4.2.11
  - DotVVM 4.3.15
  - DotVVM 5.0.0-preview09-final
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2rm3-333w-xvc4'
references:
  - url: 'https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4'
  - url: 'https://github.com/advisories/GHSA-2rm3-333w-xvc4'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T15:52:21.100Z'
ecosystem: nuget
---

## Overview

### Impact

All users of DotVVM with configured file upload storage are affected.

DotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk. 

### Patches

Since version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to have a cryptographic token, which is automatically generated by the FileUpload component. This means that users without access to any page with the FileUpload component cannot upload any files.

The patch also add the `DotvvmConfiguration.Security.AuthorizeFileUpload` option which allow you to further restrict which users can upload files. 

### Workarounds

As a workaround, you can temporarily disable file upload by removing `AddUploadedFileStorage` or `AddDefaultTempStorage` from your DotVVM configuration.

Even with the patch, we recommend configuring file upload to use a dedicated partition with limited size.

### References

* DotVVM file upload configuration: https://www.dotvvm.com/docs/4.0/pages/concepts/upload-and-download-files/upload-files

## Affected packages

- `DotVVM < 4.2.11`
- `DotVVM > 4.3.0-preview01-final, < 4.3.15`
- `DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final`

## Remediation

Upgrade to a patched release:

- `DotVVM 4.2.11`
- `DotVVM 4.3.15`
- `DotVVM 5.0.0-preview09-final`