CVE-2025-64095 is a Critical severity (CVSS 10.0) flaw in DNN Platform, formerly DotNetNuke, before 10.1.1. The default HTML editor provider allows unauthenticated file uploads, and images can overwrite existing files. Upgrade to 10.1.1 or later, which the maintainers list as the patched version.
The weakness is CWE-434, unrestricted upload of a file of a dangerous type. The Gold page for the CVE is CVE-2025-64095 on Gold. The maintainers published the advisory as GHSA-3m8r-w7xg-jqvw on 28 October 2025.
What's affected
- DNN Platform (dnnsoftware/Dnn.Platform), all versions before 10.1.1
- Patched version: 10.1.1
- Component: the default HTML editor provider
The advisory says an unauthenticated user can upload and replace existing files, which allows defacing a website. Combined with another issue, it can be used to inject cross site scripting payloads. The advisory credits bdukes and lists valadas as remediation developer. The CVSS vector shows network access, low complexity, no privileges, no user interaction and a changed scope.
How to check if you're exposed
Find your DNN version in the host settings page, or read it from the site files. On a Windows server, the file version of the main assembly shows it:
(Get-Item C:\inetpub\wwwroot\bin\DotNetNuke.dll).VersionInfo.FileVersion
Adjust the path to your install. If the version is below 10.1.1, you are in the affected range. Because DNN is often installed once and then left alone, also check old and staging copies of the site.
Next, look for signs of tampering. Compare image and static files in the portal folders against a known good backup, and look at file modification times in upload locations. The advisory gives no indicators, so this is general review.
What to do now
- Upgrade DNN Platform to 10.1.1 or later. Take a backup first and test on staging.
- Until you can upgrade, consider limiting access to the editor upload endpoints at your web application firewall or reverse proxy. The advisory lists no workaround, so check it for updates.
- Review portal file folders for files that changed unexpectedly, and restore from backup if needed.
- Review pages for injected scripts, since the advisory mentions chaining with cross site scripting.
- Make sure the application pool identity can write only where it must.
- Scan your dependencies with the free in-browser dependency scan and look up related records in the Gold directory.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
Upload features are a recurring source of serious flaws because they let outsiders put data on your server. The usual defences are checking who is allowed to upload, checking what type of file arrives, and never letting a new file replace an existing one by name. The advisory says two of those were missing here: no authentication on the default editor provider, and overwrite allowed.
Overwriting is enough to cause real damage even without running code. A changed image or script file on a public CMS is a defacement, and a changed script file can reach every visitor. The CVE is not marked as known exploited in the record. The maintainers' advisory is the source for the facts above.
Quick check
Do attackers need an account?
No. The advisory says an unauthenticated user can upload and replace existing files.
What version should I run?
Run 10.1.1 or later. The advisory lists 10.1.1 as the patched version for all earlier releases.
Sources
Last reviewed: 18 October 2026.
