VulnerabilityAnalyzed

CVE-2026-40321

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

HIGH 8.0EPSS 7.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

CVSS 3.1: 8.0 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS: 7.60% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-87
Affected: dnnsoftware/dotnetnuke
Source: security-advisories@github.com

References

https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2Release Notes
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.