GHSA-2374-6cvw-qmx6: DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Skip to content

Navigation Menu

• • GitHub Copilot

    Write better code with AI

  • GitHub Spark New

    Build and deploy intelligent apps

  • GitHub Models New

    Manage and compare prompts

  • GitHub Advanced Security

    Find and fix vulnerabilities

  • Actions

    Automate any workflow

*   Codespaces
    
    Instant dev environments
    
*   Issues
    
    Plan and track work
    
*   Code Review
    
    Manage code changes
    
*   Discussions
    
    Collaborate outside of code
    
*   Code Search
    
    Find more, search less
    

View all features

• Explore

  • Learning Pathways
  • Events & Webinars
  • Ebooks & Whitepapers
  • Customer Stories
  • Partners
  • Executive Insights

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• • Enterprise platform

    AI-powered developer platform

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-62802

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Moderate severity GitHub Reviewed Published Oct 28, 2025 in dnnsoftware/Dnn.Platform • Updated Oct 29, 2025

Package

nuget Dnn.Platform (NuGet)

Affected versions

< 10.1.1

Description

Summary

The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations.

Details

The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.

References

• GHSA-2374-6cvw-qmx6
• https://nvd.nist.gov/vuln/detail/CVE-2025-62802
• dnnsoftware/Dnn.Platform@6497d3c

Published to the GitHub Advisory Database

Oct 29, 2025

Last updated

Oct 29, 2025

EPSS score