CVE-2025-62802
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
Risk Assessment
Unauthenticated users can upload files, which may lead to placing malicious files on the server, and then to further attacks such as code execution or site takeover.
Recommendation
Update DNN to version 10.1.1 or later, which includes the fix. Additionally, review file upload permissions and restrict access to HTML editing features.
Other vulnerabilities in DNN
See all- CVE-2025-64094Medium
Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.
- CVE-2025-59539Medium
DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.
Original NVD description (English source)
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS