Dnn Platform CVE-2026-40321

Attacker must possess valid authenticated DNN user account with file upload permissions (PR:L indicates low-privileged users can typically upload files). Victim must interact with the uploaded SVG file by viewing, rendering, or accessing resources that include the malicious SVG (UI:R requirement). Exploitation requires DNN Platform versions prior to 10.2.2 where SVG sanitization is absent. Attack complexity rated High (AC:H) suggests additional factors such as: social engineering to induce victim interaction with uploaded content, knowledge of where uploaded files are rendered in the application, or specific DNN configuration allowing cross-user content visibility. The scope change indicates scripts execute in victims' security contexts regardless of the upload user's privilege level. Primary limiting factor is the dual requirement for authentication and user interaction-this is not remotely exploitable against passive targets or unauthenticated visitors.

CVSS 8.1 (High) with network vector, high attack complexity, low privileges required, and user interaction required represents a significant but not critical threat. The scope change (S:C) indicates the vulnerability affects resources beyond the vulnerable component's security scope-scripts execute in victims' browser contexts, not just the upload user's session. Attack complexity is rated 'High' because successful exploitation requires social engineering or conditions where victims view the SVG (e.g., through content galleries, user profiles, or shared resources). The requirement for both authentication (PR:L) and user interaction (UI:R) substantially reduces real-world exploitability compared to unauthenticated or zero-click vulnerabilities. No EPSS score provided-cannot assess probabilistic exploitation likelihood. No CISA KEV listing suggests no confirmed active exploitation in the wild; GitHub advisory publication indicates responsible disclosure. Primary risk is to organizations using DNN Platform where authenticated users can upload files and where content is shared among users with varying privilege levels. Exploitation targeting administrators could enable account takeover, data exfiltration, or further system compromise. This is a genuine security concern for DNN deployments but not an emergency requiring immediate out-of-band patching given the authentication and interaction requirements.

An authenticated DNN user with file upload privileges creates an SVG file embedding JavaScript payload targeting session cookies or authentication tokens. The attacker uploads this file through DNN's media library or file manager. When a site administrator browses content galleries, views user-submitted content, or accesses pages embedding the malicious SVG, the script executes in the admin's browser context with scope change allowing cross-origin impacts. The attacker's script exfiltrates the admin's session token to an external server, enabling account takeover. No public proof-of-concept code identified at time of analysis, but exploitation technique is well-documented for SVG-based XSS vectors.