CVE-2025-64094: DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

October 29, 2025

Sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios.

References

github.com/advisories/GHSA-hmvq-8p83-cq52
github.com/dnnsoftware/Dnn.Platform
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-hmvq-8p83-cq52
nvd.nist.gov/vuln/detail/CVE-2025-64094

Code Behaviors & Features

Detect and mitigate CVE-2025-64094 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →