CVE-2025-32035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32035
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32035.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32035
Aliases
  • GHSA-8q89-mqw7-9pp7
Published
2025-04-08T18:00:41.460Z
Modified
2026-07-15T01:49:18.889341760Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
DNN does not check the contents of a file when uploading files
Details

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.

Database specific 
{
    "cwe_ids": [
        "CWE-351"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32035.json"
}
References

Affected packages

Git / github.com/dnnsoftware/dnn.platform

Affected ranges

Type
GIT
Repo
https://github.com/dnnsoftware/dnn.platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
05cef8de777821c78f1449e35282cfe69def5535
Fixed
a5c13c3836cfbde374dc19dac032cd51af41050a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.13.2"
        }
    ],
    "cpe": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v9.*
v9.1.0
v9.10.0
v9.10.0-rc1
v9.10.1
v9.10.1-rc1
v9.10.2
v9.11.0
v9.11.0-rc4
v9.11.1
v9.11.1-rc1
v9.11.2
v9.11.2-rc1
v9.12.0
v9.12.0-rc1
v9.13.0
v9.13.0-rc1
v9.13.0-rc3
v9.13.1
v9.3.0-rc0
v9.3.0-rc1
v9.4.0
v9.4.0-rc0
v9.4.0-rc1
v9.4.1
v9.4.1-rc1
v9.4.2
v9.4.2-rc1
v9.4.3
v9.4.3-rc1
v9.4.4
v9.5.0
v9.5.0-rc1
v9.5.0-rc2
v9.6.0
v9.6.0-rc1
v9.6.1
v9.6.2
v9.7.0
v9.7.1
v9.7.2
v9.8.0
v9.8.0-rc1
v9.8.1
v9.8.1-rc1
v9.9.0
v9.9.1
v9.9.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32035.json"