Vulnerability · Published Apr 8, 2025 · Assigned by GitHub_M

CVE-2025-32035DNN does not check the contents of a file when uploading files

Low 2.6

In plain English

A low-severity security flaw in Dnn.Platform from dnnsoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.

Affected products (as reported)

Vendor	Product	Versions
dnnsoftware	Dnn.Platform	< 9.13.2

Weakness: CWE-351 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-8q89-mqw7-9pp7 x_refsource_CONFIRM
https://github.com/dnnsoftware/Dnn.Platform/commit/a5c13c3836cfbde374dc19dac032cd51af41050a x_refsource_MISC