CVE-2025-32035: DNN does not check the contents of a file when uploading files
First published: Tue Apr 08 2025(Updated: )
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DotNetNuke | <9.13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32035?
CVE-2025-32035 has been assessed as a medium severity vulnerability due to its potential impact on file uploads.
How do I fix CVE-2025-32035?
To fix CVE-2025-32035, upgrade to DNN version 9.13.2 or later where this vulnerability is addressed.
What types of files are affected by CVE-2025-32035?
CVE-2025-32035 affects file uploads where the file extension is checked, but the content is not verified, allowing potentially harmful files.
Which versions of DotNetNuke are impacted by CVE-2025-32035?
All versions of DotNetNuke prior to 9.13.2 are impacted by CVE-2025-32035.
What should I do if I can't upgrade to fix CVE-2025-32035?
If unable to upgrade, consider implementing additional security measures to restrict file uploads and monitor file integrity.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/dnn
- canonical/dotnetnuke