I found out today that with the version of DNN I was running, any user could navigate to the providers/htmleditorproviders/fck/fcklinkgallery.aspx page and upload a new image.

This was used to overwrite the header image used in my skin.

As such, I promptly upgraded to version 5.1.4 and tested this same URL. No longer could unauthenticated users access this file-overwriting functionality, though it still loaded the page with a dumbed-down amount of page content.

Is there a way to lock this and other potential security holes down using either file or folder permissions that will not negatively affect authenticated users accessing these potentially dangerous pages?

Thanks!

I would recommend that you write to the DotNetNuke security team for advice. You'll find their address at dotnetnuke.com.