DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

MITTEL 5.4CVE-2025-48378 · GHSA-m4hf-fxcg-cp34 · Published 23/05/2025 · updated 17/06/2026

Kurz gesagt

CVE-2025-48378 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in DotNetNuke.Core, dotnetnuke (dnnsoftware).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.29%, höher als bei 22.2% aller Schwachstellen.
Abhilfe: auf 9.13.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.13.9`	`9.13.9`
dotnetnuke dnnsoftware	`< 9.13.9`	`9.13.9`

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-48378 · ADVISORY
dnnsoftware/Dnn.Platform commit cfed83c · WEB
dnnsoftware/Dnn.Platform · PACKAGE

Weitere Schwachstellen in DotNetNuke.Core

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetNuke.Core

NuGet

< 9.13.9

9.13.9

dotnetnuke

dnnsoftware

< 9.13.9

9.13.9

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

Weitere Schwachstellen in DotNetNuke.Core

Alle anzeigen →