EUVD-2026-77698Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Dotvvm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Missing authorization in DotVVM's AuthorizeActionFilter causes any ASP.NET web application that relies on that filter to
A regular-expression denial-of-service (ReDoS) flaw in DotVVM's routing engine (DotvvmRoute.IsMatch / DotvvmRouteParser.
Exploit-DB