CVE-2025-48378: DNN (DotNetNuke) SVG XSS Vulnerability

CVE-2025-48378 Overview

CVE-2025-48378 is a stored cross-site scripting (XSS) vulnerability in DNN Platform, formerly known as DotNetNuke. DNN is an open-source content management system (CMS) built on the Microsoft .NET stack. Versions prior to 9.13.9 fail to sanitize Scalable Vector Graphics (SVG) files uploaded to the platform. Because SVG is an XML-based format that permits embedded <script> elements, an authenticated user who can upload files may embed JavaScript that executes when the SVG is rendered inline in another user's browser. The maintainers addressed the flaw in version 9.13.9. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can upload malicious SVG files that execute arbitrary JavaScript in the context of any user viewing the file inline, enabling session theft, administrative action hijacking, and defacement.

Affected Products

DNN Platform (DotNetNuke) versions prior to 9.13.9
Deployments hosted on the DNN CMS by dnnsoftware
Sites permitting user or contributor file uploads through DNN's file management APIs

Discovery Timeline

2025-05-23 - CVE-2025-48378 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-48378

Vulnerability Analysis

The DNN Platform includes a file security subsystem in DotNetNuke.Services.FileSystem.Internal that inspects uploaded content before persisting it. Prior to version 9.13.9, the SvgFileChecker class validated SVG uploads but did not remove or reject scriptable content embedded within the XML document. SVG documents are rendered by browsers as active content and can carry <script> blocks, event handlers such as onload and onclick, and javascript: URLs inside <a xlink:href> attributes.

When a DNN site serves an uploaded SVG inline through <img> substitution, <object> tags, or direct navigation, the browser parses the SVG and executes any embedded script in the origin of the DNN site. This gives the attacker access to the victim's session cookies, anti-forgery tokens, and any authenticated DNN administrative interface functionality reachable from the browser.

Root Cause

The root cause is missing neutralization of scriptable XML nodes inside the SVG validation routine. SvgFileChecker.Validate read the file content but did not strip <script> elements, event-handler attributes, or javascript: URI schemes before allowing the file to be stored and served.

Attack Vector

Exploitation requires network access to the DNN site and a low-privileged authenticated account with permission to upload files. User interaction is required: a victim must load the SVG through the DNN site. Successful exploitation causes script execution in the victim's browser session, with confidentiality impact against the subsequent web context rather than the DNN server itself.

text

// Patch reference: SvgFileChecker.cs was rewritten to enforce
// script and event-handler removal. Original validator excerpt:
namespace DotNetNuke.Services.FileSystem.Internal.SecurityCheckers
{
    public class SvgFileChecker : IFileSecurityChecker
    {
        public bool Validate(Stream fileContent)
        {
            string svgContent;
            using (var reader = new StreamReader(fileContent))
            {
                svgContent = reader.ReadToEnd();
            }
            // Prior logic did not strip <script> or on* handlers
        }
    }
}

Source: DNN Platform commit cfed83c

Detection Methods for CVE-2025-48378

Indicators of Compromise

SVG files stored under DNN portal upload directories containing <script>, onload=, onerror=, or javascript: tokens
Web server access logs showing GET requests to .svg assets followed by outbound requests to attacker-controlled domains
Newly created or modified .svg files uploaded by low-privileged DNN user accounts

Detection Strategies

Scan the DNN Portals/* file store for SVG files and grep for scriptable XML nodes such as <script, foreignObject, and on[a-z]+= attributes
Review DNN event logs for file upload events by non-administrative roles preceding suspicious sessions or credential misuse
Deploy content security policy (CSP) reporting to identify inline script execution originating from user-uploaded assets

Monitoring Recommendations

Alert on SVG uploads that fail to match a curated allowlist of DOM elements and attributes
Correlate DNN administrative session anomalies (new user creation, role changes) with recent SVG file views
Track HTTP responses serving image/svg+xml from user-upload paths and validate Content-Security-Policy and Content-Disposition headers

How to Mitigate CVE-2025-48378

Immediate Actions Required

Upgrade DNN Platform to version 9.13.9 or later, which replaces the vulnerable SvgFileChecker implementation
Audit existing SVG assets in all portals and remove or quarantine files containing script content or event handlers
Restrict file upload permissions to trusted roles until the upgrade is complete

Patch Information

The fix is delivered in commit cfed83c291d5e5072b2fa70924a8b7c35b1cdf9e and documented in GitHub Security Advisory GHSA-m4hf-fxcg-cp34. Upgrade to DNN Platform 9.13.9 or later to remediate.

Workarounds

Disable SVG uploads by removing svg from the DNN allowed file extensions list under Host Settings
Serve uploaded SVGs with Content-Disposition: attachment to force download rather than inline rendering
Enforce a strict Content Security Policy that blocks inline script execution on pages that render user content

bash

# Remove svg from DNN's allowed file extensions via SQL
# (adjust connection string and portal ID for your environment)
sqlcmd -S <server> -d <DnnDatabase> -Q \
 "UPDATE HostSettings SET SettingValue = REPLACE(SettingValue, ',svg', '') \
  WHERE SettingName = 'FileExtensions';"

# Example web.config header hardening for inline SVG assets
# <system.webServer><httpProtocol><customHeaders>
#   <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self'" />
#   <add name="X-Content-Type-Options" value="nosniff" />
# </customHeaders></httpProtocol></system.webServer>