A critical unauthenticated file upload vulnerability in DNN Dnn.Platform allows remote attackers to overwrite files and inject malicious content, posing a severe risk of full system compromise.

This vulnerability is classified as an unrestricted upload of a file with a dangerous type (CWE-434). It allows an unauthenticated attacker to upload files, overwrite existing system files, and inject malicious scripts into the environment.

The ability for an unauthenticated attacker to manipulate files on the web server represents a total compromise of the application integrity and availability. Successful exploitation can lead to website defacement, persistent cross-site scripting (XSS) attacks against users, and potential remote code execution when combined with secondary flaws. Given the CVSS score of 10.0, this vulnerability must be treated as a critical priority for all organizations running this platform.

Immediate Action: Update DNN Dnn.Platform to version 10.1.1 or later immediately to resolve the file upload vulnerability.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests targeting the HTML editor provider or attempts to upload file types that are typically disallowed in your environment.

Compensating Controls: Implement strict file type validation and directory permissions at the Web Application Firewall (WAF) level to block unauthorized file uploads to the CMS directory.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

The severity of this flaw, combined with the availability of a public proof-of-concept and a CVSS score of 10.0, mandates an immediate response. Security teams should prioritize patching DNN Dnn.Platform to version 10.1.1 across all production and development environments. Failure to update will leave the application exposed to full administrative manipulation by remote, unauthenticated attackers.