CVE-2026-40305

DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated file uploads via the default HTML editor, and images can overwrite existing files. An unauthenticated user can upload and replace files, enabling website defacement and XSS payload injection. This is fixed in 10.1.1.

All new installations of DNN 10.x.x through 10.2.1 share the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.

DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.

The DNN (formerly DotNetNuke) CMS platform in versions prior to 10.1.0 improperly handles URLs/paths and template rendering, allowing specially crafted input to be reflected into a user profile returned to the browser. The application does not sufficiently neutralize or encode HTML-significant characters, enabling an attacker to have victim browsers interpret attacker-controlled content as part of the page's HTML. The issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to JavaScript injection, affecting unsuspecting users clicking such links. This issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient filename sanitization allowing network endpoint probing. A crafted request can upload a file with Unicode characters translated into a path that could expose internal network resources. This is patched in version 10.1.0.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke) prior to version 10.1.0 allows arbitrary themes to be loaded through query parameters. If an installed theme had a vulnerability, it could be loaded on unsuspecting clients without the site owner's knowledge. This issue has been patched in version 10.1.0.