DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

CRITICAL 9.8CVE-2025-64095 · GHSA-3m8r-w7xg-jqvw · Published 28/10/2025 · updated 18/10/2026

Package	Affected versions	Patched versions
DNN.PLATFORM NuGet	`< 10.1.1`	`10.1.1`
dotnetnuke dnnsoftware	`< 10.1.1`	`10.1.1`

Description

Summary

The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.

Description

An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-64095 · ADVISORY
dnnsoftware/Dnn.Platform · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free