CVE-2025-48378: Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48378?
CVE-2025-48378 has been categorized as a high severity vulnerability due to its potential for enabling cross-site scripting (XSS) attacks.
How do I fix CVE-2025-48378?
To fix CVE-2025-48378, upgrade your DNN installation to version 9.13.9 or later.
What types of files are affected by CVE-2025-48378?
CVE-2025-48378 specifically affects uploaded SVG files that can contain scripts.
What vulnerabilities does CVE-2025-48378 expose in DNN?
CVE-2025-48378 exposes DNN installations to cross-site scripting (XSS) attacks due to improperly handled SVG file uploads.
Is CVE-2025-48378 present in earlier versions of DNN?
Yes, CVE-2025-48378 is present in DNN versions prior to 9.13.9.