DNN Platform CVE-2025-62802

Applies only to DNN (DotNetNuke) installations prior to 10.1.1 that retain the default 'out-of-box' HTML-editing experience, where the CKEditor upload endpoint is exposed to unauthenticated users. The fixed release (10.1.1) blocks this endpoint for unauthenticated users by default, so patched installs are not affected unless an implementer deliberately re-enables public uploads by editing web.config to remove the block. Limiting factors: impact is confined to file upload (Integrity-Low; no confidentiality or availability impact and no confirmed code execution), and the official CVSS marks UI:R (user interaction required), though the description implies direct unauthenticated upload - defenders should confirm whether any interaction is genuinely needed.

This is a moderate-priority issue, not a top-tier emergency, and the signals are largely consistent in pointing that way. The official CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - network-reachable and unauthenticated, but rated with only Low integrity impact and no confidentiality or availability impact, reflecting that the flaw is an unauthenticated file-upload primitive rather than confirmed code execution. The advisory itself frames it as 'a potential vector to other security issues,' i.e. a stepping stone whose real danger depends on what else an attacker can chain from an arbitrary upload (CWE-434). Exploitation-probability signals reinforce a non-urgent posture: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no public exploit identified at time of analysis. No SSVC decision data (exploitation/automatable/technical-impact) was supplied, so that framework cannot be applied. One notable tension: the official vector uses UI:R (user interaction required), yet the description describes unauthenticated users directly uploading files to an out-of-box endpoint, which typically needs no victim interaction - this suggests the real attack surface may be slightly more accessible than UI:R implies; verify the interaction requirement against the vendor's CKEditor upload flow.

An attacker who can reach a DNN site running a pre-10.1.1 default ('out-of-box') configuration sends requests to the CKEditor/HTML-editor upload endpoint without authenticating and places files on the server. Because the impact is rated Integrity-only, the realistic goal is to use the upload as a foothold - staging content or a payload that is then leveraged against another weakness. No public exploit code was identified at time of analysis.