CVE-2025-64095: 
C# 脆弱性の分析と軽減

DNN (formerly DotNetNuke), an open-source web content management platform in the Microsoft ecosystem, disclosed a critical vulnerability (CVE-2025-64095) on October 28, 2025. The vulnerability affects all versions prior to 10.1.1 and involves the default HTML editor provider allowing unauthenticated file uploads and image overwrites (NVD, GitHub Advisory).

The vulnerability has been assigned a Critical CVSS v3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability resides within the default HTML editor provider, specifically in the CKEditor provider component, affecting two endpoints: Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx and Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/Browser.aspx (Miggo).

The vulnerability allows unauthenticated users to upload and replace existing files on affected websites, enabling website defacement. When combined with other vulnerabilities, it can facilitate the injection of XSS payloads, potentially leading to session hijacking and credential theft. With over 750,000 websites using the DNN Platform, the potential impact is widespread (SecurityOnline).

The vulnerability has been patched in version 10.1.1 of the DNN Platform. Site administrators are strongly advised to update immediately to this version. Additionally, administrators should review their file logs for any unauthorized or suspicious file uploads if they were running an unpatched version (SecurityOnline).

The security community has responded with high concern due to the critical nature of the vulnerability and its potential impact on the large DNN user base. The vulnerability has garnered significant attention due to its maximum CVSS score of 10.0 and the widespread use of the DNN Platform (SecurityOnline).