DNN CKEditor Provider allows unauthenticated upload out-of-the-box
Date: 2025-10
Affected: nuget/Dnn.Platform
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-62802
CWE: CWE-434
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

### Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. ### Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.


Mitigations:

Architectural layers (MAESTRO):