CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

What is CVE-2025-64095?

CVE-2025-64095 is a critical vulnerability in Dnnsoftware Dotnetnuke, published on 28 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.

Weakness: CWE-434

Which versions are affected by CVE-2025-64095?

2 open source packages ship an affected version, including DNN.PLATFORM. It affects 1 product.

Products include Dnnsoftware Dotnetnuke.

How do I fix CVE-2025-64095?

Upgrade DNN.PLATFORM to 10.1.1 or later.

Is CVE-2025-64095 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64095 exists.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in Dnnsoftware Dotnetnuke

• CVE-2017-9822 DotNetNuke (DNN) Remote Code Execution Exploited High 8.8
• CVE-2018-15811 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2018-18325 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2006-3601 Privilege escalation in n/a Critical 10.0
• CVE-2015-2794 The installation wizard in DotNetNuke (DNN) allows privilege escalation Critical 9.8

All Dnnsoftware Dotnetnuke vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3m8r-w7xg-jqvw.