critical10.0
CVE-2025-64095
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
Impact
### Summary The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. ### Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | DNN.PLATFORM | < 10.1.1 | 10.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dnnsoftware | Dotnetnuke | before 10.1.1 |