SHSelfHostIndex
BL

BlogEngine.NET

Full-featured blogging platform for the .NET stack

Blogging Platforms ★ 985 stars Medium setup MS-PL

BlogEngine.NET is an open-source blogging platform built on ASP.NET that is easy to set up and customize. It works without a database using XML storage, or with SQL databases for larger blogs.

Official siteSource code

Key features

  • XML or SQL storage
  • Widget and theme system
  • Multi-author support
  • Built-in comment handling

Pros & cons

Strengths

  • Good fit for the .NET stack
  • No database required option

Trade-offs

  • Development has slowed
  • Smaller ecosystem

Is BlogEngine.NET secure?

10 known vulnerabilities affect BlogEngine.NET's latest release (v3.3.8.0) according to OSV.dev; the most severe is rated critical.

Affecting v3.3.8.0

AdvisorySeveritySummary
CVE-2022-41417CriticalBlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
CVE-2023-22856HighStored cross-site scripting in BlogEngine.NET version 3.3.8.0
CVE-2023-22857HighStored cross-site scripting in BlogEngine.NET version 3.3.8.0
CVE-2022-41418HighAn issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2023-33405MediumBlogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
CVE-2023-22858MediumStored cross-site scripting in BlogEngine.NET version 3.3.8.0
CVE-2022-25591UnknownBlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.
CVE-2022-28921UnknownA Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.
CVE-2022-36600UnknownBlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts.
CVE-2023-33404UnknownAn Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.
  • Most recent fixed advisory CVE-2019-10717, published 2019-07-03 (2660 days ago)

Source: OSV.dev, checked 2026-10-14. How this is measured.

BlogEngine.NET replaces

Self-hosted WordPress alternativesSelf-hosted Blogger alternatives

Health badge

Maintain BlogEngine.NET? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 11 · at risk

Markdown
[![SelfHostIndex health score for BlogEngine.NET](https://selfhostindex.com/badge/blog-engine-net.svg)](https://selfhostindex.com/app/blog-engine-net/)
HTML
<a href="https://selfhostindex.com/app/blog-engine-net/"><img src="https://selfhostindex.com/badge/blog-engine-net.svg" alt="SelfHostIndex health score for BlogEngine.NET"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/blog-engine-net.svg
   :alt: SelfHostIndex health score for BlogEngine.NET
   :target: https://selfhostindex.com/app/blog-engine-net/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare BlogEngine.NET

14 head-to-head comparisons.

Similar blogging platforms apps