CVE-2025-32035

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

08/04/2025

Last modified:

26/08/2025

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it&#39;s an allowed file type but the actual contents of the file aren&#39;t checked. This means that it&#39;s possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 2.60 LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): None