---
id: CVE-2025-13030
title: >-
  All versions of the package django-mdeditor are vulnerable to Missing
  Authentication for Critical Function in the image upload endpoint
summary: >-
  All versions of the package django-mdeditor are vulnerable to Missing
  Authentication for Critical Function in the image upload endpoint. An attacker
  can upload malicious files and achieve arbitrary code execution since this
  endpoint lack…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'
cwe:
  - CWE-306
vendor: pylixm
product: django-mdeditor
affected:
  - django-mdeditor
published: '2026-04-30'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13030'
references:
  - url: >-
      https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
    label: report@snyk.io
  - url: >-
      https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
    label: report@snyk.io
  - url: 'https://github.com/pylixm/django-mdeditor/issues/151'
    label: report@snyk.io
  - url: 'https://github.com/pylixm/django-mdeditor/pull/185'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926'
    label: report@snyk.io
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13030'
  - url: 'https://github.com/pylixm/django-mdeditor'
tags:
  - nvd
  - osv
  - pip
epss: 0.00308
epssPercentile: 0.2352
aliases:
  - GHSA-qp2c-xqv6-phh6
  - PYSEC-2026-2450
ecosystem: pip
ingestedAt: '2026-07-13T18:58:02.146Z'
---

## Overview

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

## Affected

- `django-mdeditor`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-13030)

Affected packages:

- `django-mdeditor <= 0.1.20`

Source: https://osv.dev/vulnerability/GHSA-qp2c-xqv6-phh6