medium4.3
CVE-2025-62802
DNN CKEditor Provider allows unauthenticated upload out-of-the-box
Impact
### Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. ### Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Dnn.Platform | < 10.1.1 | 10.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dnnsoftware | Dotnetnuke | before 10.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6
- https://github.com/advisories/GHSA-2374-6cvw-qmx6
- https://nvd.nist.gov/vuln/detail/CVE-2025-62802
- https://github.com/dnnsoftware/Dnn.Platform/commit/6497d3c35217e6e62e50d3ed7c8809eb69e3d06b