id: PYSEC-2026-2450
published: "2026-07-13T15:02:55.600904Z"
modified: "2026-07-13T16:03:52.263813Z"
aliases:
- CVE-2025-13030
- GHSA-qp2c-xqv6-phh6
summary: django-mdeditor is Missing Authentication for Critical Function
details: All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
affected:
- package:
    name: django-mdeditor
    ecosystem: PyPI
    purl: pkg:pypi/django-mdeditor
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 0.1.20
  versions:
  - 0.1.1
  - 0.1.10
  - 0.1.12
  - 0.1.13
  - 0.1.14
  - 0.1.15
  - 0.1.16
  - 0.1.17.1
  - 0.1.18
  - 0.1.2
  - 0.1.20
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-13030
- type: WEB
  url: https://github.com/pylixm/django-mdeditor/issues/151
- type: WEB
  url: https://github.com/pylixm/django-mdeditor/pull/185
- type: WEB
  url: https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
- type: PACKAGE
  url: https://github.com/pylixm/django-mdeditor
- type: WEB
  url: https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
- type: WEB
  url: https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926
- type: PACKAGE
  url: https://pypi.org/project/django-mdeditor
- type: ADVISORY
  url: https://github.com/advisories/GHSA-qp2c-xqv6-phh6
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P