CVE-2025-32371: Unexpected external content may be displayed in DNN ImageHandler
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32371?
CVE-2025-32371 has been rated as a critical vulnerability due to its potential to facilitate arbitrary content rendering in user-generated images.
How do I fix CVE-2025-32371?
To fix CVE-2025-32371, update your DNN installation to version 9.13.5 or later, which includes the necessary patches.
Who is affected by CVE-2025-32371?
CVE-2025-32371 affects all DNN installations up to and including version 9.13.4.
What type of vulnerability is CVE-2025-32371?
CVE-2025-32371 is a web application vulnerability that allows for the rendering of untrusted content via manipulated URLs.
Can CVE-2025-32371 lead to further security issues?
Yes, CVE-2025-32371 could potentially lead to information disclosure or other attacks if exploited by malicious users.