CVE-2025-64095: DNN.PLATFORM Insufficient Access Control Vulnerability Leading to Site Content Overwrite
Summary
CVE-2025-64095: DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite. Affects DNN.PLATFORM versions < 10.1.1. Fixed in 10.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DNN.PLATFORM is a widely used content management system (CMS) that enables users to create, manage, and publish web content easily. It provides a robust framework for building websites and applications, featuring a customizable HTML editor, user management, and a variety of modules for enhanced functionality. However, a critical vulnerability has been identified that allows unauthenticated users to upload files, potentially leading to unauthorized content manipulation and website defacement.
Vulnerability Detail
The vulnerability arises from the default HTML editor provider in DNN.PLATFORM, which permits unauthenticated file uploads. This flaw allows an attacker to upload malicious files or images that can overwrite existing files on the server. The implications of this vulnerability are severe, as it can lead to website defacement and the injection of cross-site scripting (XSS) payloads, compromising the integrity and security of the affected site.
How To Fix
Minimum fixed version
10.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict file upload permissions for unauthenticated users by modifying the configuration settings in the DNN administration panel. Disable the HTML editor or limit its access to authenticated users only until the patch is applied.
Conclusion
The CVE-2025-64095 vulnerability in DNN.PLATFORM poses a significant risk due to insufficient access control for file uploads. It is crucial for users to update to the latest version to safeguard their websites against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for DNN.PLATFORM →
FAQ
CVE-2025-64095 is a critical vulnerability in DNN.PLATFORM that allows unauthenticated users to upload files, leading to potential site content overwrite.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring signup.
The risks include unauthorized file uploads, website defacement, and the potential for cross-site scripting (XSS) attacks, which can compromise user data and site integrity.
Yes, a patch is available in version 10.1.1 of DNN.PLATFORM. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, implement the workaround by restricting file upload permissions for unauthenticated users until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for DNN.PLATFORM.
