Introduction
An attacker can overwrite any file on a vulnerable DNN Platform site without logging in, which allows instant defacement or the injection of malicious content. The flaw is critical and affects every DNN Platform installation prior to version 10.1.1. Organizations running those versions face severe operational and reputational risk.
DNN Platform (formerly DotNetNuke) is a major open-source web content management system built on the Microsoft .NET stack. Enterprises, public sector organizations, and developers use it widely to build and manage web applications. Because it is extensible and integrates with Microsoft technologies, it is a popular choice in .NET-centric environments, with thousands of deployments worldwide.
Technical Information
CVE-2025-64095 is caused by insufficient validation and access control in DNN Platform's default HTML editor provider prior to version 10.1.1. The provider's file upload function does not require authentication and does not run proper file handling checks. Any remote user can therefore upload arbitrary files and overwrite existing content, bypassing the security boundaries the platform is meant to enforce.
- The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
- An attacker crafts an HTTP POST request to the HTML editor's file upload endpoint and specifies the path and filename to overwrite.
- Because the endpoint has no authentication, exploitation needs no credentials or session tokens.
- Overwritten files can include static assets, web pages, or files the application processes, so an attacker can deface the site or inject cross-site scripting (XSS) payloads.
- The attack is network-based and works remotely over HTTP or HTTPS.
Affected Systems and Versions
- DNN Platform (formerly DotNetNuke) prior to version 10.1.1
- All configurations that use the default HTML editor provider
- Version 10.1.1, released September 26, 2025, contains the fix
Vendor Security History
DNN Software has fixed several earlier critical vulnerabilities in DNN Platform:
- CVE-2025-59545: Stored XSS in the Prompt module (prior to 10.1.0)
- CVE-2025-52488: NTLM credential exposure via Unicode normalization (6.0.0 through 10.0.0)
- CVE-2025-59547: CKEditor file upload Unicode issues
Security advisories usually appear within a month of the patch release. The community and the vendor both work actively on security issues, but file upload and input validation flaws keep coming back, and they remain an ongoing challenge for the project.
