CVE-2025-62802: Dnn.Platform Allows Unauthenticated File Uploads
Summary
CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box. Affects Dnn.Platform versions < 10.1.1. Fixed in 10.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dnn.Platform is a widely used content management system (CMS) built on the .NET framework, designed for creating and managing web applications. It offers a range of features including customizable modules, user management, and a rich text editor powered by CKEditor. However, a significant security flaw has been identified that allows unauthenticated users to upload files, posing a risk to the integrity and security of the system.
Vulnerability Detail
The vulnerability arises from the default configuration of the DNN CKEditor Provider, which permits unauthenticated users to upload files. This oversight can lead to various security issues, including unauthorized access to sensitive data, potential server compromise, and exploitation of the system for malicious purposes. The vulnerability is classified under CWE-434, indicating improper handling of file uploads, which can have severe implications if exploited.
How To Fix
Minimum fixed version
10.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround involves editing the web.config file to restrict access to the file upload endpoint. This can be done by ensuring that the relevant configuration settings block unauthenticated access. However, this should only be a temporary measure until the package can be updated.
Conclusion
The Dnn.Platform vulnerability CVE-2025-62802 poses a significant risk by allowing unauthenticated file uploads. It is crucial to update to the patched version 10.1.1 to mitigate this risk. For those unable to update immediately, a temporary workaround is available by modifying the web.config file. Regular monitoring with tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for Dnn.Platform →
FAQ
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
Yes, the vulnerability allows unauthenticated users to upload files, which can be exploited remotely.
Exploitation can lead to unauthorized access, data breaches, and potential server compromise.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for Dnn.Platform.
