CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box

October 29, 2025

The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations.

References

github.com/advisories/GHSA-2374-6cvw-qmx6
github.com/dnnsoftware/Dnn.Platform
github.com/dnnsoftware/Dnn.Platform/commit/6497d3c35217e6e62e50d3ed7c8809eb69e3d06b
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6
nvd.nist.gov/vuln/detail/CVE-2025-62802

Code Behaviors & Features

Detect and mitigate CVE-2025-62802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →