CVE-2025-59535 (Medium) detected in dotnetnuke.core.9.9.0.nupkg

[mend-bolt-for-github]

CVE-2025-59535 - Medium Severity Vulnerability

Vulnerable Library - dotnetnuke.core.9.9.0.nupkg

Provides basic references to the DotNetNuke.dll to develop extensions for the DNN Platform. For MVC or WebAPI please see other packages available as well

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.9.0.nupkg

Path to vulnerable library: /Modules/PageSettingsEditor/packages/DotNetNuke.Core.9.9.0/DotNetNuke.Core.9.9.0.nupkg

Dependency Hierarchy:

• ❌ dotnetnuke.core.9.9.0.nupkg (Vulnerable Library)

Found in HEAD commit: 8727e4bba1fb8bb6a2721c00a891d080c7f11b90

Found in base branch: main

Vulnerability Details

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Publish Date: 2025-09-22

URL: CVE-2025-59535

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq2j-w9pm-7x2p

Release Date: 2025-09-22

Fix Resolution: https://github.com/dnnsoftware/Dnn.Platform.git - v10.1.0,DotNetNuke.Core - 10.1.0

---

Step up your Open Source Security Game with Mend here