CVE-2026-57578: Missing Authorization

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

PT-2026-91280

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

PT-2026-91279

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

CVE-2026-57581: Unrestricted Upload of File with Dangerous Type

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

DotVVM: Unrestricted file upload

Impact All users of DotVVM with configured file upload storage are affected. DotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk. Patches Since version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to hav...

Arbitrary File Upload

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can exhaust disk space by uploading arbitrary...

DotVVM: Missing authorization in AuthorizeActionFilter

Impact All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter. Patches DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this. Workarounds As a workaround, you can use the AuthorizeAttribute instead. It...

Missing Authorization

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Missing Authorization in the AuthorizeActionFilter process. An attacker can gain unauthorized access to...

ReDoS in DotVVM routing

Impact This impacts users which use multiple unconstrained route parameters not separated by a /. For instance, the following code is vulnerable: var route = new DotvvmRoute"edit/a-b-c/done", null, "testpage", null, null, configuration; var adversarialInput = "edit/" + new string'-', 32000;...

Regular Expression Denial of Service (ReDoS)

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the routing process when multiple unconstrained route parameter...

EUVD-2025-29385

Malicious code in bioql PyPI...

Path Traversal

DotVVM is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation allowing the attacker to access the arbitrary files when a FileResourceLocation is used and the application is running in Debug mode...

DotVVM allows path traversal when deployed in Debug mode

Description There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the FileResourceLocation has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application i.e...

GHSA-6Q65-J4JW-9CG8 DotVVM allows path traversal when deployed in Debug mode

Description There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the FileResourceLocation has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application i.e...

Directory Traversal

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Directory Traversal via the FileResourceLocation process in Debug mode. An attacker can access sensitive file...

PT-2025-27372 · Nuget · Dotvvm

Description There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the FileResourceLocation has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application i.e...