A vulnerability in DNN Platform prior to version 10.2.2 allows an attacker to upload a specially crafted SVG file that may contain malicious scripts. The scripts are stored and later rendered by the platform, enabling cross‑site scripting attacks that affect both authenticated and unauthenticated users. If the victim is a privileged user, the impact extends to higher‑privilege accounts, potentially leading to session hijacking or data theft.

The issue affects installations of DNN Platform up to but not including version 10.2.2. The affected product is DNN Platform (formerly DotNetNuke) by dnnsoftware. Users of any deployment of the CMS that has not applied the 10.2.2 update are vulnerable.

The CVSS score of 8.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. The vulnerability can be exploited by uploading a malicious SVG file through the web interface;unauthenticated visitors can trigger the payload via public upload endpoints, while authenticated users can be targeted as well. No special prerequisites beyond access to an upload page are needed, making it readily exploitable for attackers. The likely attack vector is a web‑based file upload.