CVE-2025-64095: DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
Summary The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Published Oct 29, 2025
Affected packages
DNN.PLATFORM
- Ecosystem
- NuGet
- Affected
- < 10.1.1
- Fixed in
- 10.1.1
- Check
dotnet list package --include-transitive
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.
Description
An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Credited to bdukes, valadas.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology