CVE-2025-59548: DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59548?
CVE-2025-59548 has a critical severity rating due to its potential to allow JavaScript injection through specially crafted URLs.
How do I fix CVE-2025-59548?
To fix CVE-2025-59548, upgrade to DNN version 10.1.0 or later, which addresses the vulnerabilities related to JavaScript injection.
Who is affected by CVE-2025-59548?
CVE-2025-59548 affects all DNN versions prior to 10.1.0, potentially compromising users who click on malicious links.
What impact does CVE-2025-59548 have on users?
Users may be subject to JavaScript injection attacks, leading to unauthorized actions or data exposure when they interact with the vulnerable FileBrowser.
Is a patch available for CVE-2025-59548?
Yes, a patch is available in DNN version 10.1.0 and later, which mitigates the vulnerability.