DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

中危 5.4CVE-2025-48378 · GHSA-m4hf-fxcg-cp34 · Published 23/05/2025 · updated 17/06/2026

要点

CVE-2025-48378 是影响 DotNetNuke.Core, dotnetnuke (dnnsoftware) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.29%，高于 22.2% 的漏洞。
修复：升级到 9.13.9 或更高版本。

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.13.9`	`9.13.9`
dotnetnuke dnnsoftware	`< 9.13.9`	`9.13.9`

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-48378 · ADVISORY
dnnsoftware/Dnn.Platform commit cfed83c · WEB
dnnsoftware/Dnn.Platform · PACKAGE

DotNetNuke.Core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetNuke.Core

NuGet

< 9.13.9

9.13.9

dotnetnuke

dnnsoftware

< 9.13.9

9.13.9

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

DotNetNuke.Core 的其他漏洞

查看全部 →