External risk intelligence

DNN Unauthenticated File Upload Leading to Defacement and XSS.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64095

DNN is a content management system (CMS) designed specifically to be a public-facing web platform. The vulnerability exists within the application's core functionality, which is intended for internet-accessible web hosting and content management.

Unrestricted File Upload

Dnnsoftware Dotnetnuke

before 10.1.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DNN web content management platform, specifically affecting versions prior to 10.1.1. This issue allows unauthenticated users to upload and overwrite existing files, potentially leading to website defacement and the injection of malicious content.

Unauthenticated file uploads can overwrite existing content.
Could lead to website defacement and content injection.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated user can exploit a vulnerability in the default HTML editor provider of DNN to upload and replace existing files on a website. This allows for website defacement and, when combined with other issues, the injection of cross-site scripting (XSS) payloads.

No authentication required.
Uploading or replacing files.
Website defacement and XSS injection.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated user could overwrite existing files on a DNN website, potentially leading to website defacement. When combined with other issues, this could also enable the injection of XSS payloads.

Website files.
Unauthenticated file uploads.
Website defacement and XSS.

Operational Fix

Recommended remediation, mitigation, and detection steps

Website owners and platform teams are primarily responsible for addressing this vulnerability in the DNN content management system. The first practical step is to identify all DNN instances, confirm their reachability and criticality, and then coordinate remediation efforts with the accountable owners.

Application owners should own the issue.
Verify DNN instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DNN and how is it used?

DNN, formerly known as DotNetNuke, is an open-source content management system built on the Microsoft .NET framework. Organizations use it as a foundational platform to build, host, and manage dynamic websites, portals, and web applications, leveraging its modular architecture to handle web content and site structure.

What does CWE-434 mean regarding CVE-2025-64095?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, the vulnerability exists within the default HTML editor component. It allows a remote user to upload files to the server without needing to log in. Because the system does not properly restrict these uploads, an attacker can replace legitimate site files with their own, leading to unauthorized content changes or the injection of malicious scripts.

Does this vulnerability require user interaction to trigger?

No. This vulnerability does not require an attacker to have a user account or interact with a logged-in administrator to function. It is a direct flaw in how the HTML editor processes incoming file data. If the editor is active and accessible, the lack of authentication checks is the primary condition that enables the file replacement process.

How do I know if my DNN instance is at risk?

According to Halo Surface Signal, DNN is specifically designed as a public-facing platform, making it a high-priority target for internet-based attacks. If your instance is accessible over the internet, it is inherently exposed to this risk. You should prioritize assessing any DNN deployment that handles public web traffic or is otherwise reachable from external networks.

How can I secure my site against this vulnerability?

The most effective way to address this issue is to upgrade your DNN installation to version 10.1.1 or higher. This version contains the security fixes necessary to restrict file uploads properly. Before applying the update, perform an inventory of all your DNN instances to ensure you have full visibility into which sites require patching and to coordinate the update with the relevant application owners.

References

github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.