dnnsoftware/dnn.platform · Security
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
- GHSA ID
- GHSA-3m8r-w7xg-jqvw
- CVE ID
- CVE-2025-64095
- Severity
- critical
- Published
- Updated
- CVSS
- 10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
Summary
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.
Description
An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type