CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box

CVE-2025-62802 · Severity: medium · CVSS 4.3 · Published 2025-10-28

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.

Technologies: Dnnsoftware Dotnetnuke, Dnn.Platform (NuGet). Vendors: Dnnsoftware, NuGet.

Quick answers

Is CVE-2025-62802 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62802 being exploited in the wild.
How severe is CVE-2025-62802?
Medium severity, with a CVSS score of 4.3, published 28 October 2025.
Which products and versions are affected?
Dnn.Platform (NuGet) ECOSYSTEM:introduced=0,fixed=10.1.1.
Is there a fix for CVE-2025-62802?
Yes. Dnn.Platform (NuGet): upgrade to 10.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-62802?
Check whether you run Dnnsoftware Dotnetnuke or Dnn.Platform (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Dnn.Platform (NuGet): upgrade to 10.1.1 or later
    dotnet add package Dnn.Platform --version 10.1.1

Affected products

  • Dnnsoftware Dotnetnuke
  • Dnn.Platform (NuGet) ECOSYSTEM:introduced=0,fixed=10.1.1

Identifiers

  • CVE-2025-62802
  • GHSA-2374-6cvw-qmx6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.