{"id":"GHSA-6q65-j4jw-9cg8","summary":"DotVVM allows path traversal when deployed in Debug mode","details":"### Description\n\nThere is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the `FileResourceLocation` has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application (i.e. appsettings.json or other files containing secrets).\n\n### Patches\n\nThe bug is patched in versions  **4.2.10**, **4.3.8** and **5.0.0-preview03-final** (and newer).\n\nApart from updating DotVVM, it is also recommend invalidating any secrets which could have been leaked by an application deployed in Debug mode (such as database passwords).\n\n### Workarounds\n\nIf you cannot update to a patched version, avoid running a publicly accessible DotVVM application in Debug mode (Development environment in Asp.Net Core). It is recommend adding the following statement to the DotvvmStartup class:\n\n```\n    config.Debug = false; // TODO: workaround for GHSA-6q65-j4jw-9cg8, remove after updating DotVVM\n```","modified":"2025-06-19T15:01:15.592590Z","published":"2025-06-19T14:40:30Z","database_specific":{"github_reviewed_at":"2025-06-19T14:40:30Z","nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-6q65-j4jw-9cg8"},{"type":"WEB","url":"https://github.com/riganti/dotvvm/commit/68db0110beeda4e8e4be1b7c4e480ef876895bb5"},{"type":"PACKAGE","url":"https://github.com/riganti/dotvvm"}],"affected":[{"package":{"name":"DotVVM","ecosystem":"NuGet","purl":"pkg:nuget/DotVVM"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-preview01-final"},{"fixed":"4.3.8"}]}],"versions":["4.3.0","4.3.0-preview01-final","4.3.0-preview02-final","4.3.0-preview03-final","4.3.0-preview04-final","4.3.0-preview05-final","4.3.0-preview06-final","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.3.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6q65-j4jw-9cg8/GHSA-6q65-j4jw-9cg8.json"}},{"package":{"name":"DotVVM","ecosystem":"NuGet","purl":"pkg:nuget/DotVVM"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-preview01-final"},{"fixed":"5.0.0-preview03-final"}]}],"versions":["5.0.0-preview01-final","5.0.0-preview02-final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6q65-j4jw-9cg8/GHSA-6q65-j4jw-9cg8.json"}},{"package":{"name":"DotVVM","ecosystem":"NuGet","purl":"pkg:nuget/DotVVM"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10"}]}],"versions":["0.6.0-pre","0.7.0-pre","0.7.0.1-pre","0.7.0.2-pre","0.7.0.3-pre","0.7.0.4-pre","0.7.0.5-pre","0.7.0.6-pre","0.7.0.7-pre","0.7.0.8-pre","0.8.0-pre","0.8.1-pre","0.8.1.1-pre","0.8.1.2-pre","0.8.2-pre","0.8.2.1-pre","0.8.2.2-pre","0.8.2.3-pre","0.8.3-pre","0.8.3.1-pre","0.8.3.10-pre","0.8.3.2-pre","0.8.3.3-pre","0.8.3.4-pre","0.8.3.5-pre","0.8.3.6-pre","0.8.3.7-pre","0.8.3.8-pre","0.8.3.9-pre","0.8.4-pre","0.8.4.1-pre","0.8.4.2-pre","0.8.5-pre","0.8.5.1-pre","0.8.5.10-pre","0.8.5.2-pre","0.8.5.3-pre","0.8.5.4-pre","0.8.5.5-pre","0.8.5.6-pre","0.8.5.7-pre","0.8.5.8-pre","0.8.5.9-pre","0.8.6-pre","0.8.6.1-pre","0.8.6.13-pre","0.8.6.2-pre","0.8.6.3-pre","0.8.6.4-pre","0.8.6.5-pre","0.8.6.6-pre","0.8.6.7-pre","0.9.0","1.0.0","1.0.0-beta","1.0.0-rc","1.0.0-rc2","1.0.0.7-rc2","1.0.1","1.0.2","1.0.5","1.1.0","1.1.0-alpha","1.1.0-beta","1.1.0-rc","1.1.0-rc3","1.1.0-rc5","1.1.0.1","1.1.1","1.1.2","1.1.5","1.1.6","1.1.6.1","1.1.6.2","1.1.6.3","1.1.7","1.1.8","1.1.8.1","1.1.8.2","1.1.9","1.1.9.1","1.1.9.2","1.1.9.3","1.1.9.4","1.2.0-alpha1","2.0.0","2.0.0-beta-01","2.0.0-beta01","2.0.0-preview01-final","2.0.0-preview02-final","2.0.0-preview03-final","2.0.0-preview04-final","2.0.0-preview05-final","2.0.0-preview06-final","2.0.0-preview07-final","2.0.0-preview08-final","2.0.1","2.0.1-preview01-final","2.0.1-preview02-final","2.0.1-preview03-final","2.0.1-preview04-final","2.0.1-preview05-final","2.0.2","2.0.3","2.0.3-preview01-final","2.0.3-preview02-final","2.1.0","2.1.0-preview01-final","2.2.0","2.2.0-preview01-final","2.2.0-preview02-final","2.2.0-preview03-final","2.2.0.1","2.2.0.2","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.0-preview01-final","2.4.0-preview03-final","2.4.0-preview06-final","2.4.0.1","2.5.0","2.5.0-preview02-final","2.5.0-preview04-final","2.5.1","2.5.2","3.0.0","3.0.0-preview02-final","3.0.0-preview03-final","3.0.0-preview04-final","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.0-preview01-final","3.1.0-preview02-final","3.1.0-preview03-final","3.1.0-preview04-final","3.1.0-preview05-final","3.1.0-preview07-final","3.1.1","3.2.0","3.2.0-preview01-final","3.2.0-preview02-final","3.2.1","3.2.2","3.2.3","4.0.0","4.0.0-preview01-final","4.0.0-preview02-final","4.0.0-preview03-final","4.0.0-preview05","4.0.0-preview05-final","4.0.0-preview06-final","4.0.0-preview07-final","4.0.0-preview08-final","4.0.0-preview09-final","4.0.0-preview10-final","4.0.0-preview11-final","4.0.0-preview13-final","4.0.0-preview15-final","4.0.1","4.0.10","4.0.11","4.0.12","4.0.12-preview04-569028","4.0.13","4.0.2","4.0.3","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0-preview01-final","4.1.0-preview03-final","4.1.0-preview04-final","4.1.0-preview05-final","4.1.0-preview06-final","4.1.0-preview07-final","4.1.0-preview09-final","4.1.0-preview10-final","4.1.0-preview11-final","4.1.0-preview12-final","4.1.0-preview13-final","4.1.0-preview14-final","4.1.0-preview18-final","4.1.0-preview19-final","4.1.0-preview21-final","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2.0","4.2.0-preview01-final","4.2.0-preview02-final","4.2.0-preview03-final","4.2.0-preview04-final","4.2.0-preview05-final","4.2.0-preview06-final","4.2.0-preview07-final","4.2.0-preview08-final","4.2.0-preview09-final","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6q65-j4jw-9cg8/GHSA-6q65-j4jw-9cg8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}