CVE-2025-64095

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

47% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-25)

CWE

CWE-434

Published

2025-10-28

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• dnnsoftware:dotnetnuke

References

• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw

Check your stackJSON