UpHeron
All vulnerabilities

Servers and applications

CVE-2025-32035

File contents aren't checked when uploading files

Severity
High 7.5
Published
8 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.13.2
Also known as
GHSA-8q89-mqw7-9pp7
Sources
NVD, Project advisories (GitHub)

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could…

Affected software

SoftwareAffected versions
DNN PlatformServers and applications · cpe:a:dnnsoftware:dotnetnuke
  • Every version before 9.13.2
DNN PlatformServers and applications · github:dnnsoftware/dnn.platform
  • Every version before 9.13.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-32035
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-32035
  • GitHub Advisory Database https://github.com/advisories/GHSA-8q89-mqw7-9pp7
  • github.com https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-8q89-mqw7-9pp7