CVE-2020-5187: 
C# vulnerability analysis and mitigation

DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal vulnerability, identified as CVE-2020-5187. This vulnerability was discovered in the zip file extraction functionality of DNN's file upload feature and was reported in February 2020 (Medium Blog).

The vulnerability is a directory traversal attack, also known as a Zip Slip vulnerability, that exploits insufficient validation of directory names during archive extraction. The vulnerability affects the zip file extraction function in DNN's file upload feature, allowing attackers to potentially overwrite files with specific extensions on the system (Medium Blog).

An attacker could exploit this vulnerability to replace files with specific extensions on the system, including jpg, jpeg, jpe, gif, bmp, png, svg, ttf, eot, woff, doc, docx, xls, xlsx, ppt, pptx, pdf, txt, xml, xsl, xsd, css, zip, rar, template, htmtemplate, ico, avi, mpg, mpeg, mp3, wmv, mov, wav, mp4, webm, and ogv files. This could potentially lead to unauthorized file access and system compromise (Medium Blog).

The vulnerability was patched in DNN Platform version 9.5.0-rc0001. Users should upgrade to this version or later to mitigate the risk (Medium Blog).