CVE-2025-64095: DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
Summary The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.
Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Other sources
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64095?
CVE-2025-64095 is considered a critical vulnerability due to its potential for unauthenticated file uploads and file overwrites.
How do I fix CVE-2025-64095?
To mitigate CVE-2025-64095, upgrade DNN to version 10.1.1 or higher, where the issue has been resolved.
Who is affected by CVE-2025-64095?
CVE-2025-64095 affects all DNN installations prior to version 10.1.1.
What types of attacks can exploit CVE-2025-64095?
CVE-2025-64095 can be exploited by unauthenticated attackers who can upload malicious files and overwrite existing files on the server.
What is the potential impact of CVE-2025-64095?
The potential impact of CVE-2025-64095 includes unauthorized access to web server files, defacement, and possible exploitation of uploaded malicious files.