What is GHSA-2rm3-333w-xvc4?

GHSA-2rm3-333w-xvc4 is a security advisory published by GitHub Security Advisories with Medium severity. DotVVM: Unrestricted file upload

Why does GHSA-2rm3-333w-xvc4 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2rm3-333w-xvc4?

GHSA-2rm3-333w-xvc4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2rm3-333w-xvc4?

GHSA-2rm3-333w-xvc4 affects 3 products, including: nuget/DotVVM:\u003c 4.2.11; nuget/DotVVM:\u003e 4.3.0-preview01-final, \u003c 4.3.15; nuget/DotVVM:\u003e= 5.0.0-preview01-final, \u003c 5.0.0-preview09-final.

GHSA-2rm3-333w-xvc4MediumCVSS 5.3Disclosed before NVD

DotVVM: Unrestricted file upload

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

📋 Description

Impact

All users of DotVVM with configured file upload storage are affected.

DotVVM allows anyone to upload files to the application, potentially causing denial of service by filling the disk.

Patches

Since version 4.3.15, 4.2.11 and 5.0.0-preview09, DotVVM requires all file upload request to have a cryptographic token, which is automatically generated by the FileUpload component. This means that users without access to any page with the FileUpload component cannot upload any files.

The patch also add the DotvvmConfiguration.Security.AuthorizeFileUpload option which allow you to further restrict which users can upload files.

Workarounds

As a workaround, you can temporarily disable file upload by removing AddUploadedFileStorage or AddDefaultTempStorage from your DotVVM configuration.

Even with the patch, we recommend configuring file upload to use a dedicated partition with limited size.

References

DotVVM file upload configuration: https://www.dotvvm.com/docs/4.0/pages/concepts/upload-and-download-files/upload-files

🎯 Affected products3

nuget/DotVVM:< 4.2.11
nuget/DotVVM:> 4.3.0-preview01-final, < 4.3.15
nuget/DotVVM:>= 5.0.0-preview01-final, < 5.0.0-preview09-final