GitHub Advisoryadvisory · NuGet

GHSA-2374-6cvw-qmx6 DNN CKEditor Provider allows unauthenticated upload out-of-the-box

MEDIUM Published 2025-10-29 Modified 2025-10-29 Official page ↗
Aliases
CVE-2025-62802
Ecosystem
NuGet
Packages
Dnn.Platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-434
Reviewed
2025-10-29

Affected packages

• NuGet Dnn.Platform: < 10.1.1 → fixed in 10.1.1

Description

Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.

Related

Alias · CVE (1)

  • CVE-2025-62802 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References