CVE-2025-59547
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient filename sanitization allowing network endpoint probing. A crafted request can upload a file with Unicode characters translated into a path that could expose internal network resources. This is patched in version 10.1.0.
Risk Assessment
An attacker could access internal network resources, potentially leading to data exposure or further attacks on the infrastructure.
Recommendation
Upgrade DNN to version 10.1.0 or later, which includes the fix.
Other vulnerabilities in DNN
See all- CVE-2025-64095Critical
DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated file uploads via the default HTML editor, and images can overwrite existing files. An unauthenticated user can upload and replace files, enabling website defacement and XSS payload injection. This is fixed in 10.1.1.
- CVE-2025-64094Medium
Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.
- CVE-2025-62802Medium
DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- CVE-2025-59821Medium
The DNN (formerly DotNetNuke) CMS platform in versions prior to 10.1.0 improperly handles URLs/paths and template rendering, allowing specially crafted input to be reflected into a user profile returned to the browser. The application does not sufficiently neutralize or encode HTML-significant characters, enabling an attacker to have victim browsers interpret attacker-controlled content as part of the page's HTML. The issue has been patched in version 10.1.0.
- CVE-2025-59548Medium
DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to JavaScript injection, affecting unsuspecting users clicking such links. This issue has been patched in version 10.1.0.
- CVE-2025-59546Low
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.
- CVE-2025-59539Medium
DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.
- CVE-2025-59535Medium
DNN (formerly DotNetNuke) prior to version 10.1.0 allows arbitrary themes to be loaded through query parameters. If an installed theme had a vulnerability, it could be loaded on unsuspecting clients without the site owner's knowledge. This issue has been patched in version 10.1.0.
Original NVD description (English source)
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A specially crafted request can be made to upload a file with Unicode characters, which would be translated into a path that could expose resources in the internal network of the hosted site. This issue has been patched in version 10.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS