---
id: CVE-2025-59548
title: >-
  DNN (formerly DotNetNuke) is an open-source web content management platform
  (CMS) in the Microsoft ecosystem
summary: >-
  DNN (formerly DotNetNuke) is an open-source web content management platform
  (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted
  URLs to the FileBrowser are vulnerable to javascript injection, affecting any
  unsusp…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: dnnsoftware
product: dotnetnuke
affected:
  - dotnetnuke < 10.1.0
patched:
  - dotnetnuke 10.1.0
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59548'
references:
  - url: >-
      https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-5fj9-542v-w4rq
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00188
epssPercentile: 0.07745
ingestedAt: '2026-10-12T14:50:33.983Z'
---

## Overview

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0.

## Affected

- `dotnetnuke < 10.1.0`

## Remediation

Upgrade past the affected range:

- `dotnetnuke 10.1.0`