CVE-2025-64094: DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

The analysis of the security advisory and the associated commit clearly indicates that the vulnerability is a stored XSS in the SVG file upload functionality of DNN Platform. The commit 360256d4296e2b0d53ef004a877c3f80e91d0a73 directly addresses this issue by modifying the SvgFileChecker.cs file.

The core of the vulnerability is in the DotNetNuke.Services.FileSystem.Internal.SecurityCheckers.SvgFileChecker.Validate method. The original code used a simple and incomplete blacklist to check for malicious content, which could be easily bypassed. The patch replaces this with a robust allow-list approach, only permitting known-safe SVG elements and attributes. This change is the direct remediation for the vulnerability.

The FileManagerTests.cs file was also updated in the same commit to include a large number of new test cases with various XSS payloads in SVG files. These tests confirm that the FileManager.AddFile method is the entry point that triggers the validation, and that the changes in SvgFileChecker.Validate are intended to prevent these malicious files from being uploaded. Therefore, the Validate function is identified as the vulnerable function.