CVE-2026-57581: 
C# vulnerability analysis and mitigation

CVE-2026-57581 is an unrestricted file upload vulnerability in DotVVM, an open-source MVVM framework for ASP.NET applications. It affects all users of DotVVM with configured file upload storage, specifically versions prior to 4.2.11, prior to 4.3.15, and prior to 5.0.0-preview09-final. The vulnerability was published on June 18, 2026, and has a CVSS v3.1 base score of 5.3 (Moderate) (GitHub Advisory, DotVVM Advisory).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). DotVVM's file upload endpoint did not require any authentication or cryptographic token to accept file uploads, meaning any unauthenticated network attacker could send arbitrary files to the application's upload storage without restriction. No user interaction or special privileges are required to exploit this vulnerability — an attacker only needs network access to the application and knowledge that DotVVM's file upload endpoint is exposed (GitHub Advisory, DotVVM Advisory).

The primary impact is a denial of service (DoS) condition caused by disk exhaustion: an unauthenticated attacker can repeatedly upload large or numerous files to fill the server's disk, potentially rendering the application and host system unavailable. There is no direct confidentiality or integrity impact identified. The scope is limited to the affected DotVVM application and its underlying storage, but disk exhaustion could affect co-hosted services on the same partition (GitHub Advisory).

No public exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for this vulnerability. The attack complexity is low and requires no privileges or user interaction, making it straightforward for any attacker with network access to exploit. No EPSS score or CISA KEV catalog entry is currently associated with CVE-2026-57581 (DotVVM Advisory).

1. Reconnaissance: Identify a publicly accessible DotVVM application running a vulnerable version (< 4.2.11, < 4.3.15, or < 5.0.0-preview09-final) with file upload storage configured (i.e., AddUploadedFileStorage or AddDefaultTempStorage present in configuration).
2. Locate the upload endpoint: DotVVM exposes a standard file upload HTTP endpoint (typically at /_dotvvm/fileupload) that accepts multipart file upload requests.
3. Send unauthenticated upload requests: Using a tool such as curl or a custom script, send repeated HTTP POST requests with large or numerous file payloads to the upload endpoint — no authentication token or session is required on vulnerable versions.
4. Exhaust disk space: Continue uploading files until the server's disk partition used for temporary file storage is filled, causing a denial of service condition for the application and potentially other services sharing the same partition (GitHub Advisory).

• Network: High volume of HTTP POST requests to /_dotvvm/fileupload (or equivalent DotVVM upload endpoint) from one or more external IP addresses, especially without corresponding authenticated sessions.
• File System: Rapid growth or exhaustion of disk space in the configured DotVVM temporary file upload storage directory; presence of large numbers of unexpected files in the upload storage path.
• Logs: Web server or application logs showing repeated unauthenticated POST requests to the file upload endpoint, potentially from automated scripts (high request rate, uniform user-agent strings, or sequential timing) (GitHub Advisory).

Upgrade DotVVM to patched versions 4.2.11, 4.3.15, or 5.0.0-preview09-final, which require all file upload requests to include a cryptographic token automatically generated by the FileUpload component, preventing unauthenticated uploads. The new DotvvmConfiguration.Security.AuthorizeFileUpload option can be used to further restrict upload access to specific users. As an immediate workaround, disable file upload by removing AddUploadedFileStorage or AddDefaultTempStorage from the DotVVM configuration. Additionally, it is recommended to configure file upload storage on a dedicated partition with a limited size quota to contain the impact even after patching (DotVVM Advisory).