Vulnerability · Published Oct 28, 2025 · Assigned by GitHub_M
CVE-2025-64095DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
Critical 10.0
In plain English
A critical-severity unrestricted file upload in Dnn.Platform from dnnsoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 47.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | dnn.platform | 10.1.1 | GHSA-3m8r-w7xg-jqvw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dnnsoftware | Dnn.Platform | < 10.1.1 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H