{"id":"GHSA-6q65-j4jw-9cg8","aliases":[],"url":"https://o3.security/vulnerability/GHSA-6q65-j4jw-9cg8","summary":"DotVVM allows path traversal when deployed in Debug mode","details":"### Description\n\nThere is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).\n\n### Patches\n\nThe bug is patched in versions  **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer).\n\nApart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).\n\n### Workarounds\n\nIf you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:\n\n```\n    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM\n```","published":"2025-06-19T14:40:30Z","modified":"2025-06-19T15:01:15.592590Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"DotVVM","fixedVersion":"4.3.8"},{"ecosystem":"NuGet","name":"DotVVM","fixedVersion":"5.0.0-preview03-final"},{"ecosystem":"NuGet","name":"DotVVM","fixedVersion":"4.2.10"}],"fix":{"url":"https://github.com/riganti/dotvvm/commit/68db0110beeda4e8e4be1b7c4e480ef876895bb5","label":"riganti/dotvvm@68db011"},"references":[{"type":"WEB","url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-6q65-j4jw-9cg8"},{"type":"WEB","url":"https://github.com/riganti/dotvvm/commit/68db0110beeda4e8e4be1b7c4e480ef876895bb5"},{"type":"PACKAGE","url":"https://github.com/riganti/dotvvm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-06-19T15:01:15.592590Z"}}