CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box
Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations.
Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.
Other sources
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62802?
The severity of CVE-2025-62802 is considered significant due to the potential exploitation by unauthenticated users allowing file uploads.
How do I fix CVE-2025-62802?
To fix CVE-2025-62802, update DNN to version 10.1.1 or later to mitigate the vulnerability.
What impact does CVE-2025-62802 have on my system?
CVE-2025-62802 allows unauthenticated users to upload files, potentially leading to other security risks such as unauthorized access or code execution.
Who is affected by CVE-2025-62802?
CVE-2025-62802 affects all DNN users running versions prior to 10.1.1.
Is CVE-2025-62802 part of a larger vulnerability trend?
Yes, CVE-2025-62802 is indicative of file upload vulnerabilities that can allow attackers to leverage web applications for unauthorized actions.