GitHub Advisoryadvisory · PyPI

GHSA-qp2c-xqv6-phh6 django-mdeditor is Missing Authentication for Critical Function

LOW Published 2026-04-30 Modified 2026-05-06 Official page ↗
Aliases
CVE-2025-13030
Ecosystem
PyPI
Packages
django-mdeditor
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-306
Reviewed
2026-05-06

Affected packages

• PyPI django-mdeditor: <= 0.1.20 (no fix yet)

Description

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

Related

Alias · CVE (1)

  • CVE-2025-13030 All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References