OrchardCMS/OrchardCore · error · AntivirusScanningException

The ClamAV antivirus scanner is enabled but the host…

Error message

The ClamAV antivirus scanner is enabled but the host setting is missing.

What it means

The antivirus module validates ClamAvOptions before every scan. Because the feature is enabled but options.Host is null/empty/whitespace, ValidateOptions throws this AntivirusScanningException on the first file upload rather than silently skipping scanning.

Solutions

Configure the ClamAV host, e.g. via configuration or services.AddClamAv(o => o.Host = "clamd").
Check appsettings.json/appsettings.{env}.json for the correct ClamAV section and key names.
Verify config binding (environment variable prefixes, Azure App Configuration) actually reaches the app.
Validate at startup (fail fast) so missing host is caught before users upload files.

Example fix

// before
// feature enabled, no host configured
// after
services.AddClamAv(options => { options.Host = "clamd"; options.Port = 3310; });

Defensive patterns

Strategy: validation

Validate before calling

// at startup
var opts = configuration.GetSection("OrchardCore_Antivirus_ClamAV").Get<ClamAvOptions>();
if (string.IsNullOrWhiteSpace(opts?.Host))
    throw new InvalidOperationException("ClamAV is enabled but Host is not configured.");

Try / catch

try
{
    await UploadFileAsync(stream);
}
catch (AntivirusScanningException ex) when (ex.Message.Contains("host setting is missing"))
{
    // fail deployment/startup validation instead of letting uploads 500
}

Prevention

Validate ClamAvOptions at startup with IOptions validation.
Keep one source of truth for the config section name across environments.
Use CI config smoke tests that boot the app with production settings.

When it happens

Trigger: Antivirus/ClamAV feature enabled, a file upload triggers CreatingAsync, and _options.Host is null or whitespace because it was never configured.

Common situations: Enabling the ClamAV feature without adding configuration, appsettings section name typo, config binding not mapped to ClamAvOptions, missing environment variable in deployment.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/55a380f0243099b7. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Antivirus/ClamAV/ClamAvFileEventHandler.cs:164

            signature = signature[..^" FOUND".Length];

            stream.Position = 0;

            return FileCreatingResult.Failed(stream, new ResultError
            {
                Message = new LocalizedString(nameof(ClamAvFileEventHandler), $"The uploaded file '{context.FileName}' was rejected because ClamAV detected '{signature}'."),
            });
        }

        throw new AntivirusScanningException(
            $"The ClamAV antivirus scanner returned an unexpected response while scanning '{context.FileName}': {response}");
    }

    private void ValidateOptions()
    {
        if (string.IsNullOrWhiteSpace(_options.Host))
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the host setting is missing.");
        }

        if (_options.Port is < 1 or > 65535)
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the port setting is invalid.");
        }

        if (_options.ConnectTimeoutSeconds <= 0)
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the connection timeout must be greater than zero.");
        }

        if (_options.TransferTimeoutSeconds <= 0)
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the transfer timeout must be greater than zero.");
        }
    }
}

View on GitHub (pinned to 4306c0717f)