CVE-2025-13030

HIGH

django-mdeditor < 0.1.20 - Unauthenticated Arbitrary File Upload and Remote Code Execution via Image Upload Endpoint

Title source: llm

Description

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

References (5)

Core 5

Core References

https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926

https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25

https://github.com/pylixm/django-mdeditor/issues/151

https://github.com/pylixm/django-mdeditor/pull/185

https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe

View Patch ZIP pw:eip

Scores

CVSS v3 7.1

EPSS 0.0031

EPSS Percentile 22.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (3)

None/django-mdeditor

pylixm/django-mdeditor

pypi/django-mdeditor 0 - 0.1.20PyPI

Published Apr 30, 2026

Tracked Since Apr 30, 2026