DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

HIGH 8.0CVE-2026-40321 · GHSA-ffq7-898w-9jc4 · Published 17/04/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 10.2.2`	`10.2.2`
dotnetnuke dnnsoftware	`< 10.2.2`	`10.2.2`

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

NVD description

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-40321 · ADVISORY
dnnsoftware/Dnn.Platform · PACKAGE
dnnsoftware/Dnn.Platform release v10.2.2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free