GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities by riganti

    CVE-2026-57581 (GCVE-0-2026-57581)

    Vulnerability from nvd – Published: 2026-09-14 17:35 – Updated: 2026-09-14 17:35
    VLAI
    Title
    DotVVM: Unrestricted file upload
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:35:30.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-2rm3-333w-xvc4",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: Unrestricted file upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57581",
    "datePublished": "2026-09-14T17:35:30.580Z",
    "dateReserved": "2026-06-24T18:49:56.209Z",
    "dateUpdated": "2026-09-14T17:35:30.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-57578 (GCVE-0-2026-57578)

    Vulnerability from nvd – Published: 2026-09-14 17:39 – Updated: 2026-09-14 17:39
    VLAI
    Title
    DotVVM: Missing authorization in AuthorizeActionFilter
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:39:25.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/7578cf3459097cbbef0d3fea8a7774509b324112",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/7578cf3459097cbbef0d3fea8a7774509b324112"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-c8qj-jx8j-fg2w",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: Missing authorization in AuthorizeActionFilter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57578",
    "datePublished": "2026-09-14T17:39:25.197Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:39:25.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-57577 (GCVE-0-2026-57577)

    Vulnerability from nvd – Published: 2026-09-14 17:37 – Updated: 2026-09-14 17:54
    VLAI
    Title
    DotVVM: ReDOS in routing
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    8.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-14 17:54 UTC
    CWE
    • CWE-1333 - Inefficient Regular Expression Complexity
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:54:17.670075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T17:54:30.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:37:54.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-c2g3-c4gc-w5wg",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: ReDOS in routing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57577",
    "datePublished": "2026-09-14T17:37:54.739Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:54:30.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-57578 (GCVE-0-2026-57578)

    Vulnerability from cvelistv5 – Published: 2026-09-14 17:39 – Updated: 2026-09-14 17:39
    VLAI
    Title
    DotVVM: Missing authorization in AuthorizeActionFilter
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:39:25.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/7578cf3459097cbbef0d3fea8a7774509b324112",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/7578cf3459097cbbef0d3fea8a7774509b324112"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-c8qj-jx8j-fg2w",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: Missing authorization in AuthorizeActionFilter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57578",
    "datePublished": "2026-09-14T17:39:25.197Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:39:25.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-57577 (GCVE-0-2026-57577)

    Vulnerability from cvelistv5 – Published: 2026-09-14 17:37 – Updated: 2026-09-14 17:54
    VLAI
    Title
    DotVVM: ReDOS in routing
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    8.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-14 17:54 UTC
    CWE
    • CWE-1333 - Inefficient Regular Expression Complexity
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:54:17.670075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T17:54:30.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:37:54.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-c2g3-c4gc-w5wg",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: ReDOS in routing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57577",
    "datePublished": "2026-09-14T17:37:54.739Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:54:30.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-57581 (GCVE-0-2026-57581)

    Vulnerability from cvelistv5 – Published: 2026-09-14 17:35 – Updated: 2026-09-14 17:35
    VLAI
    Title
    DotVVM: Unrestricted file upload
    Summary
    DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    References
    Impacted products
    Vendor Product Version
    riganti dotvvm Affected: < 4.2.11
    Affected: >= 4.3.0, < 4.3.15
    Affected: >= 5.0.0-preview01, < 5.0.0-preview09-final
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dotvvm",
          "vendor": "riganti",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-preview01, \u003c 5.0.0-preview09-final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:35:30.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riganti/dotvvm/security/advisories/GHSA-2rm3-333w-xvc4"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"
        },
        {
          "name": "https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/commit/6af982bbe3b00bdac00f1c0efe9365d52db642ef"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v4.3.15"
        },
        {
          "name": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"
        }
      ],
      "source": {
        "advisory": "GHSA-2rm3-333w-xvc4",
        "discovery": "UNKNOWN"
      },
      "title": "DotVVM: Unrestricted file upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57581",
    "datePublished": "2026-09-14T17:35:30.580Z",
    "dateReserved": "2026-06-24T18:49:56.209Z",
    "dateUpdated": "2026-09-14T17:35:30.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}