CVE-2025-64095
Critical · 10.0DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
CVSS
10.0
EPSS
47.0%
Published
Oct 29, 2025
CISA due date
—
The record
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | DNN.PLATFORM | 0 | 10.1.1 |
Related vulnerabilities
- GHSA-3m8r-w7xg-jqvw DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite Same vulnerability
- CVE-2025-52488 DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input Also affects DNN.PLATFORM
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434
- CVE-2026-54611 InstantCMS is a free and open source content management system. CWE-434