DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

MEDIUM 5.4CVE-2025-48378 · GHSA-m4hf-fxcg-cp34 · Published 23/05/2025 · updated 17/06/2026

In short

CVE-2025-48378 is a MEDIUM (CVSS 5.4) vulnerability affecting DotNetNuke.Core, dotnetnuke (dnnsoftware).
Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 22.2% of all vulnerabilities.
Fix: update to 9.13.9 or later.

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.13.9`	`9.13.9`
dotnetnuke dnnsoftware	`< 9.13.9`	`9.13.9`

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-48378 · ADVISORY
dnnsoftware/Dnn.Platform commit cfed83c · WEB
dnnsoftware/Dnn.Platform · PACKAGE

More vulnerabilities in DotNetNuke.Core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetNuke.Core

NuGet

< 9.13.9

9.13.9

dotnetnuke

dnnsoftware

< 9.13.9

9.13.9

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

More vulnerabilities in DotNetNuke.Core

See all →