GitHub Advisoryadvisory · NuGet

GHSA-3m8r-w7xg-jqvw DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

CRITICAL Published 2025-10-29 Modified 2025-10-29 Official page ↗
Aliases
CVE-2025-64095
Ecosystem
NuGet
Packages
DNN.PLATFORM
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2025-10-29

Affected packages

• NuGet DNN.PLATFORM: < 10.1.1 → fixed in 10.1.1

Description

Summary The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.

Related

Alias · CVE (1)

  • CVE-2025-64095 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References