CVE-2026-57581

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

CVE-2026-57581

DotVVM , an open-source MVVM framework for web applications, is affected by an unrestricted file upload vulnerability in DotvvmFileUploadMiddleware . Prior to versions 4.2.11 , 4.3.15 , and 5.0.0-preview09-final , applications with configured file upload storage do not validate the X-DotVVM-Uploa...

PT-2026-91281

Name of the Vulnerable Software and Affected Versions DotVVM versions prior to 4.2.11 DotVVM versions prior to 4.3.15 DotVVM versions prior to 5.0.0-preview09-final Description Applications using configured file upload storage allow unauthenticated users to submit files directly to the...