DNN Platform CVE-2025-64094

Exploitation requires an authenticated DNN account with permission to upload files (PR:L), since the attack vector is uploading a malicious SVG whose embedded script evades DNN's SVG content sanitization. A second limiting factor is required user interaction (UI:R): a victim must subsequently render or view the uploaded SVG in their browser for the payload to fire. The vulnerability is only reachable because the sanitization introduced for CVE-2025-48378 does not comprehensively strip script elements, so it affects configurations where untrusted or lower-privileged users are permitted to upload content. Instances with no untrusted uploaders, or that block SVG uploads entirely, are not realistically exposed.

This is a moderate-severity stored XSS (CWE-79) with a solid CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scoring 5.4, and the signals are internally consistent rather than conflicting. PR:L confirms an authenticated attacker is required - specifically a user with permission to upload files - and UI:R confirms a victim must view the malicious SVG, both of which meaningfully gate exploitation and argue against treating this as a drop-everything issue. EPSS is low at 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of active or widespread exploitation. The scope change (S:C) is the one factor that elevates concern: a successful payload executes in the browser context of other users, including potentially administrators, enabling session hijacking and privilege escalation beyond the attacker's own account. Notably, this is an incomplete fix for CVE-2025-48378, meaning the original sanitization-bypass problem recurred - a signal that the SVG filtering logic is fragile and worth prioritizing for patching even though raw scores are only medium. Overall this is a real but not urgent issue: prioritize patching on internet-facing or multi-tenant DNN instances where untrusted users can upload content.

An authenticated DNN user with file-upload permissions crafts an SVG file containing JavaScript that evades the incomplete sanitization filter and uploads it to the platform. When another user - such as an administrator browsing uploaded content - opens or renders the SVG in their browser, the script executes in their session context, enabling session hijacking, data exfiltration, or defacement. No public exploit code was identified in the provided data, but the technique is well understood and the recurrence of an earlier bypass (CVE-2025-48378) indicates the attack is practical.