Loading story…
A critical flaw in the open-source DotNetNuke CMS, tracked as CVE-2026-40321, allows attackers to turn a malicious SVG upload into full server compromise by hijacking an administrator’s authenticated browser session. The attack begins when an attacker uploads an SVG file containing JavaScript and persuades a privileged user to open it; the script then runs in that user’s session and abuses trusted access inside the application. Reports say the issue affects a platform used by more than 750,000 websites and can lead to command execution, malware deployment, data theft, and disruption of security tools on the underlying Windows server.
The compromise chain uses DotNetNuke’s authenticated file-write functionality, including the /API/personaBar/ConfigConsole/UpdateConfigFile endpoint, to write an ASPX web shell or other backdoor to disk. Because the technique relies on legitimate SVG files, native browser execution, standard HTTP traffic, and authenticated requests, common controls such as antivirus, firewalls, and malware-removal tools may not reliably detect or block it. An official patch is available, and defenders are being urged to prioritize updates, restrict or disable unnecessary SVG and anonymous uploads, and review user registration settings that could expose the attack path.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
An official patch was made available for the DotNetNuke vulnerability, with defenders advised to prioritize patching, restrict or disable unnecessary SVG and anonymous uploads, and review user registration policies. Reports noted the issue could affect more than 750,000 websites using the platform.
A cross-site scripting vulnerability in DotNetNuke CMS, tracked as CVE-2026-40321, was reported as allowing attackers to upload a malicious SVG that executes in a privileged user's browser session. The flaw can be chained with an authenticated file-write endpoint to place an ASPX web shell on the server and achieve full server compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechradar.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, CVE-2025-64095, has been identified in the DNN Platform, an open-source CMS widely used in the Microsoft ecosystem. The flaw, rated CVSS 10.0, allows unauthenticated attackers to upload files via the default HTML editor provider, enabling them to overwrite existing files on the server. This can result in complete compromise of website confidentiality, integrity, and availability, including defacement and the potential for further attacks such as stored XSS, session hijacking, and credential theft. All versions prior to 10.1.1 are affected, and administrators are strongly urged to update to version 10.1.1 immediately. The vulnerability is notable for its ease of exploitation, requiring no authentication or privileges. Security advisories recommend that site owners review file logs for unauthorized uploads or modifications if running unpatched versions. The DNN Platform team has released a patch, and immediate action is advised to mitigate the risk of exploitation and potential website compromise.
Jun 29, 2026
A critical vulnerability in the WordPress plugin **Ninja Forms – File Uploads** has exposed more than **50,000 sites** to unauthenticated arbitrary file upload, with security researchers and CSIRT.SK reporting active exploitation in the wild. Tracked as `CVE-2026-0740`, the flaw affects versions **3.3.26 and earlier** and stems from insufficient validation of uploaded file types, file extensions, and file paths in `NF_FU_AJAX_Controllers_Uploads::handle_upload`, allowing attackers to upload malicious files, including PHP scripts. Successful exploitation can lead to **remote code execution** and full site compromise, giving attackers a path to persistent access and broader server takeover. Defenders are urged to update immediately to **version 3.3.27 or later** and review affected WordPress installations for unauthorized uploads or filesystem changes, as public reporting indicates the vulnerable plugin was deployed on tens of thousands of websites at the time of disclosure.
Jul 24, 2026
A critical vulnerability, **CVE-2026-94545**, enables unauthenticated remote code execution in the Node.js implementation of Next.js `ImageResponse`/`next/og` when applications place attacker-controlled values into server-generated SVG elements, attributes, or styles. The issue stems from Satori failing to safely handle unescaped SVG output, allowing crafted input submitted through exposed parameters, forms, or APIs to potentially execute code on the image-generation server. Vercel fixed the flaw in Next.js **16.3.6**; versions **16.2.0 through 16.3.5** are affected. Next.js 15 and Edge-runtime `ImageResponse` deployments are not vulnerable, and Node.js deployments that never render untrusted data into SVG are not exposed through this condition. Organizations should identify affected installations and upgrade immediately; direct Satori users should update to **0.33.5**. No public exploitation or exploit code had been reported at the time of disclosure.
Sep 24, 2026