docs(dnn): #131 9.11.1→9.13.x security palier sandbox plan - #479
Merged
Conversation
Secondary task of ai-01 dispatch `slfy5i`. Documents the intermediate security palier 9.11.1 -> 9.13.x that closes CVE-2025-64095 (CVSS 9.8, unauthenticated file upload via HTML editor provider) WITHOUT the gated 10.x jump (eshop/OpenStore, Stripe, jsboige go-live). Honest scoping: 9.13.x does NOT patch CVE-2025-52488 (NTLM hash exposure, requires 10.0.1) -- documented as residual risk, mitigated by the #442 hardenings (AES/HMACSHA256 machineKey, requireSSL cookies, CSP) already merged on master 092bb8f. Verified current state by code: DotNetNuke.dll ProductVersion = 9.11.1 (web.config InstallVersion=09.06.02 is a legacy sticker, NOT runtime truth); .NET target 4.8 (9.13.x stays on 4.8, no .NET 8+ jump); 2sxc 21.x + Argumentum Razor14 templates are the integration risk to verify. Plan is sandbox-prep only -- no prod touch, no tag, release v0.9.0 gate unaffected. Execution blocked until jsboige provisions sandbox copy + disk headroom (C: ~9 GB free / 100%). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This was referenced Jun 15, 2026
jsboige
added a commit
that referenced
this pull request
Jun 17, 2026
…reversal (#511) Dispatch primaire (msg-20260616T230902-yz54sv). Doc-only, sandbox/research scope. Extends (not duplicates) #479 plan + UPGRADE-ASSESSMENT. Two verified reversals vs the 2026-06-07 assessment: 1. CVE-2025-52488 (NTLM) patched in DNN 10.0.1 ONLY (not 9.13.x). ASSESSMENT §3 is wrong; #479 §1 was right. The 9.13.x palier closes only 1/2 CVEs. 2. DNN 10.x runtime is .NET Framework 4.8 (not .NET 8). Proven by DNN core contributors (Valadas/Breumelhof, forum) + 2sxc: v21.00.02 ships a workaround for a DNN 10.02.01 bug => .NET-Framework-compiled 2sxc runs on DNN 10.02.01. => OpenStore/NBrightBuy blocker likely DISSOLVES (re-asks Stripe Native #445). Adds: CVE reconciliation table, 2sxc<->DNN-10 compat (v21 runs on DNN 10.02.01, min DNN 9.11.02), 2sxc app compat matrix (Argumentum custom=HIGH audit, Glossary3 v14-era=MEDIUM bump, News5/Blog5=GO), 9.x->10.x breaking-change list (2sxc v20 Moment-of-Truth: module path rename, SQL reorg, SexyContentWebPage removal), 4-step staircase with go/no-go per step (Step 0 = confirm DNN 10 runtime = THE gate). Gate boundaries: sandbox only, no prod deploy, no CSV touch, no dnn-ui-strings.csv, does not overturn Stripe Native decision (surfaces it). ASSESSMENT §3 correction proposed as follow-up, not edited in place. Sources: dnncommunity.org forum, docs.2sxc.org changelog, SystemVll/CVE-2025-52488, repo web.config/DotNetNuke.dll/Glossary3 app.xml. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sandbox prep plan for the DNN 9.11.1 → 9.13.x security palier (secondary of dispatch
slfy5i, #131). Doc-only, +125 lines, 1 new file (docs/dnn-localization/131-upgrade-9.13-sandbox-plan.md). No code, no runtime effect, no prod touch.Delivered by worker po-2023 via patch-handoff (push-blocked 403); SHA256 verified
f6240ecf…beforegit am.What the plan covers (code-verified, SDDD)
DotNetNuke.dllProductVersion) —web.config InstallVersion=09.06.02is a legacy sticker, not the truth.Gate
Release v0.9.0 gate unaffected — DNN migration is a separate, non-gated track. The 10.x jump (eshop/OpenStore, go-live) stays out of scope (gated by jsboige). Sandbox execution awaits jsboige prod access + disk headroom (C: ~9 GB, prune is jsboige's).
Refs #131.
🤖 Generated with Claude Code