CVE-2025-62802CWE-1188CWE-434unrestricted-file-upload

CVE-2025-62802

Medium · published October 29, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-10-29T02:15Z
Affected products (1)
ProductVersionsFixed in
dnnsoftware/dotnetnuke< 10.1.110.1.1
References (1)
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6 · [email protected]
EPSS history
Timeline
  • 28 OCT 21:42Z
    DNN CKEditor Provider allows unauthenticated upload out-of-the-box
    cvelistv5